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PREFACE 


—7  Recent  advances  in  systems  concepts  allied  to  new  technology  have  led  to  the  possibility  of  integrating  a  variety  of 
systems  that  have  traditionally  been  separate. 

In  this  symposium,  the  potential,  and  problems,  of  integrating  mission  critical  and  flight  critical  systems  will  be  . 

examined. 

Such  integrated  systems  can  be  expected  to  improve  the  performance  of  an  aircraft  in  all  phases  of  a  mission. 

During  the  enroute  and  return  phases  fuel  conservation  flight  profiles  may  be  available.  Prior  to  an  attack  energy 
management  profiles  will  be  available  to  maximise  the  energy  of  the  attacker^nd  during  the  attack  phase  integrated  fire 
and  flight  control  will  maximise  the  firing  opportunities.  Similar  considerations  apply  to  missiles  and  other  unmanned 
vehicles. 

In  addition,  integration  of  these  control  systems  is  expected  to  provide  enhancements  of  flight  safety  by  reducing 
pilot  workload.  A  further  improvement  in  survivability  is  also  to  be  expected  from  the  use  of  curved  attack  profiles  in 
both  air-to-air  and  air-to-ground  attacks  particularly  when  such  systems  are  coupled  to  direct  force  controls  or  vectored 
thrust  controls.  _ 


Des  progr is  ricents  realises  dans  la  conception  des  systemes  alliis  aux  nouvclles  technologies  ont  conduit  a  envisage! 
llntegration  de  divers  systimes  traditionncDement  indipendants. 

Au  cours  de  ce  symposium  nous  examinerons  les  diffirentes  method es  d  'integration  des  systimes  commander  de  tir, 
commandes  de  vol,  et  commander  moteur. 

De  tela  systimes  integris  devraient  ami  borer  les  performances  des  avion  s  dans  toutes  les  phases  de  leur  mission. 
Durant  les  phases  de  vol,  en  route  et  au  retour,  des  pro  fils  de  vol  rtduisant  la  consummation  de  carbunnt  pourront  itre 
employes.  Avant  l’attaque,  des  profils  de  vola  contrdlant  l'energie  seront  etablis  pour  augmenter  au  maximum  I'inergie 
diaponible  de  I'attaquant  et,  pendant  les  phases  d’attaque,  le  controle  integrf  systime  de  tir/commandes  de  vol  optimisera 
les  occasions  de  tir.  Des  considerations  semblablet  peuvent  s'itendre  aux  missiles  et  autres  engins  sans  pilotes. 

De  plus,  I’integration  de  ces  systimes  de  contrile  devrait  apporter  des  ameliorations  i  la  sicuriti  des  vob  en  ridui- 
aant  la  charge  de  travail  du  pilote.  Une  amelioration  additionnelle  de  la  survivabihti  est  igalement  attendue  de  I'emploi  de 
courbes  d’attaques  incurvies,  tant  en  attaques  air-air  qu’en  attaques  air-sol,  particubirement  torsque  de  tels  systimes  sont 
couplis  avec  des  commandes  par  forces  directes  ou  par  poussies  vectoriellet. 
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TECHNICAL  EVALUATION  REPORT 

by 

C.Baron,  M.Sc. 

Ministry  of  Defence 
London 


1.  INTRODUCTION 

The  36th  Symposium  of  the  Guidance  and  Control  Panel  of  AGARD  was  held  at  the  Ecole  Nationals  Superieure 
de  l’Aeronautique  et  de  l’Espace,  Toulouse,  France,  from  the  17th  to  20th  May  1983.  The  Programme  Chairman  was 
Mr  J.T.Shepherd,  of  Marconi  Avionics,  Rochester,  Kent,  UK,  who  was  assisted  by  members  of  the  Flight  Mechanics  and 
the  Propulsion  and  Energetics  Panels  of  AGARD. 


2.  THEME  AND  OBJECTIVES 

In  the  early  days  of  aircraft,  and  to  some  degree  to  this  day,  integration  of  the  complete  aircraft  system  was 
performed  by  the  pilot,  taking  his  infor  mation  from  his  instruments  and  his  own  physical  sensations,  analysing  it, 
computing  in  his  own  brain  the  required  control  actions,  and  putting  them  into  effect.  Increasing  demands  on  the  aircraft 
system  capability  led  to  increased  workload;  this  was  met  in  the  first  instance  by  improvement  of  sub-units,  but  at  the 
same  time  sub  units  proliferated  and  it  became  necessary  to  integrate  them  in  groups,  so  that  the  pilot  only  had  to  deal 
with  the  flight  control  system,  the  fire  control  system  or  the  engine  control  system,  instead  of  having  to  involve  himself 
individually  with  all  the  sub  units  in  these  groups. 

Pressure  for  further  increases  in  capability  would  now  be  expected  to  lead  to  a  more  integrated  approach  to  the 
whole  aircraft  system,  and  new  technology  has  stimulated  the  development  of  new  system  concepts  which  together  make 
major  advances  in  this  direction  possible.  To  set  against  better  performance  and  lower  workload,  however,  there  will  be 
penalties  -  greater  complexity,  probably  more  in  the  software  than  the  hardware,  with  attendant  cost  and  reliability 
problems,  possibly  reduced  flexibility,  and  the  need  to  ensure  safety  while  integrating  flight  critical  systems  with  others 
which  are  only  mission  critical.  If  progress  is  to  be  achieved  there  are  complex  balances  to  be  struck  -  how  best  to  take 
the  pay-off,  how  to  minimise  the  penalties,  and  the  best  balance  to  strike  between  them.  This  will  only  be  successfully 
achieved  by  bringing  together  people  of  many  disciplines  -  the  operators  and  Hie  operational  analysts,  the  experts  in 
flight  control,  fire  control  and  engine  control,  who  have  traditionally  worked  to  a  degree  in  isolation,  specialists  in  human 
factors,  in  -^liability  and  maintenance  (of  software,  particularly)  and  so  on. 

The  aim  of  this  symposium  was  to  examine  the  potential  and  problems  of  integration,  particularly  where  flight 
critical  and  mission  critical  systems  are  both  involved.  Its  timeliness,  insofar  as  the  current  state  of  the  art  is  concerned,  is 
quite  apparent,  and  the  potential  value  of  bringing  people  from  the  different  NATO  nations  together  on  the  subject  is 
peat. 

Unfortunately,  delegates  arriving  at  the  conference  expecting  to  hear  the  published  programme  of  24  papers  were 
surprised  to  team  that  S  papers,  aU  from  the  US,  had  been  withdrawn  at  the  last  minute.  The  129  people  whose  time  and 
travel  costs  had  been  committed  had  every  reason  to  regard  this  situation  as  scandalous,  and  it  is  thank fufiy  without 
precedent  in  the  history  of  AGARD.  In  the  event,  both  organisers  and  audience  responded  to  the  situation  very  weB,  and 
good  use  was  made  of  the  extended  discussion  periods  which  resulted. 


3.  TECHNICAL  CONTENT 


The  symposium  was  welcomed  to  the  coOege  by  its  Director,  Ing  Gen.  Fkmrens,  who  gave  an  interesting  account  of 
the  place  of  college  in  the  French  system  of  higher  eduction,  its  history  and  organisation.  Having  been  founded  in  Paris 
in  1909,  ENSAE  claims  to  be  the  eldest  aerospace  school  in  the  world. 


The  Keynote  Address  was  given  by  rr  Werner  M.p  .rich,  of  the  West  German  Federal  Ministry  of  Defence. 
After  touching  briefly  on  the  history  of  t  '■earn'  ^ne  control  systems  he  showed  how  the  advance  of  digital 


techniques  has  now  made  the  comprehensive  integration  of  these  systems  possible.  However  the  great  complexity  of  the 
software  that  would  be  involved  makes  consideration  of  software  reliability  most  important,  and  it  will  set  limits  to  the 
degree  of  integration  practicable.  He  postulated  a  major  difference  in  software  complexity  between  complete  or  total 
integration  and  “reasonable’  integration,  which  he  defined  as  comprising  optimised  subsystems  coupled  together  through 
well  defined  interfaces.  This  he  felt  would  not  fully  meet  user  requirements  for  system  performance  and  reduction  of 
workload,  but  would  come  much  closer  to  their  requirements  for  cost,  serviceability,  testability  and  flexibility  of  integra¬ 
tion  of  new  weapons  and  equipment.  It  is  the  responsibility  of  technical  people  to  ensure  that  the  right  compromise 
between  these  factors  is  achieved. 

Session  I  -  Integration  of  Fire  Control  Systems 

The  first  paper  (2,  Aden)  provided  an  example  of  an  integrated  weapon/fire  control  system  concept,  developed  to 
meet  the  perceived  need  to  attack  numbers  of  tank  targets  simultaneously  and  at  low  cost,  from  an  aircraft  at  high  speed 
and  low  level.  Innovation  features  were  the  case  of  a  hyper  velocity  missile,  with  corrected  beam  riding  guidance  based 
on  a  small  amplitude,  precision  raster  scanning  laser  beam,  some  features  of  which  had  already  been  tested.  The  concept 
seemed  likely  to  stand  or  fall,  however,  on  the  ability  to  obtain  rapid  reaction  through  automatic  target  acquisition,  using 
FLIR  in  the  first  instance,  or  later,  perhaps,  a  laser  radar.  The  paper  aroused  considerable  interest  and  provoked  many 
questions,  mostly  on  matters  of  fact. 

The  next  paper(3)  by  Brodersen  described  the  integration  of  an,  essentially,  existing  weapon,  the  Penguin  ASM, 
with  an  existing  aircraft,  the  F-16.  It  demonstrated  that  the  flexibility  of  modem  digital  systems  can  provide  for  the 
interfacing  of  two  complex  equipments  and  still  allow  great  flexibility  in  use.  The  conclusion  that  no  hardware  changes 
were  necessary  but  very  considerable  software  was  required  is  perhaps  typical  of  our  times. 

Barling  in  his  paper  (4)  dealt  with  the  integration  of  three  normally  separate  sub  units  to  form  a  single  sub  unit,  with 
the  main  benefit  of  lower  cost.  Previous  conferences  have  heard  descriptions  of  the  combination  of  headup  display  and 
weapon  aiming  computers,  and  this  was  now  carried  a  stage  further  by  the  inclusion  of  the  navigation  unit.  In  this  case 
integration  was  more  physical  than  functional,  and  the  interface  with  the  pilot  was  therefore  different  mainly  in  being 
confined  to  a  very  limited  panel  space  -  this  constraint  was  elegantly  dealt  with  by  the  use  of  illuminated  push  buttons. 
Having  thus  achieved  economy  largely  through  the  use  of  a  common  computer,  the  author  was  led  to  consider  whether 
this  indicated  a  trend  towards  total  integration  through  a  single  central  computer;  like  Herr  Fraedrich  he  rejected  this 
idea,  however,  because  of  the  need  then  to  raise  the  integrity  of  all  parts  of  the  system  to  the  level  of  the  most  demanding, 
and  also  because  of  problems  of  common  mode  failures. 

Next  Triebe  presented  a  paper  (S)  written  in  conjunction  with  Schrammer,  describing  the  auto  attack  modes  in  the 
Tornado  weapon  system,  with  particular  reference  to  delivery  of  the  German  MW1  and  Kormoran  weapons. 

Unfortunately  the  paper  was  almost  entirely  descriptive,  with  little  reference  to  the  logical  basis  of  the  design  or  to  the 
lessons  learned  from  it;  this  was  probably  why  this  was  the  only  paper  in  the  session  to  arouse  no  question  from  the 
audience. 

The  final  paper  of  the  session  (Roquefeuil,  6)  set  out  in  very  logical  fashion  the  arguments  involved  in  the  design  of 
an  electro  optical  sight  and  fire  control  system  for  helicopter  air  to  air  gunfire.  The  need  for  quick  reaction  and  minimum 
crew  workload  had  led  to  maximum  use  of  automatics  and  careful  choice  of  the  functions  required  of  the  crew.  Flight 
tests  to  verify  operation  of  automatic  target  tracking  and  determine  optimum  parameters  were  briefly  discussed. 

The  mostly  active  question  periods  after  the  individual  papers  were  supplemented  by  a  final  more  general  discussion, 
which  quickly  turned  to  the  role  of  the  aircrew  -  are  they  needed  and  if  so  what  for?  While  the  view  was  expressed  that 
most  of  the  flight  control  tasks  should  be  automated  to  allow  the  crew  to  concentrate  on  the  weapon/target  tasks,  it  was 
also  stated  that  the  pilot’s  feel  for  the  aircraft  is  most  important  for  man-machine  integration,  therefore  if  there  is  a  man 
in  the  vehicle  he  should  be  a  pilot.  It  might  have  been  pointed  out,  though  it  was  not,  that  the  objections  of  Heri 
Fraedrich  and  Mr  Barling  to  total  integration  tend  to  disappear  if  there  is  no  pilot  -  conversely,  with  total  integration 
there  may  be  no  need  for  a  pilot,  as,  for  example,  in  guided  missiles.  Threre  was  general  agreement,  however,  that  air 
staffs  composed  of  pilots  are  never  likely  to  produce  requirements  for  aircraft  without  pilots. 

Session  II  -  Integration  of  Propulsion  Control  Systems 

This  was  an  interesting  session  in  which  the  feasibility  of  beneficial  technology  transfer  was  demonstrated  in 
generous  acknowledgement  by  engine  control  system  designers  of  their  debt  to  flight  control  system  technology.  The 
opening  paper  (7)  by  Seemann  and  Lockenour,  demonstrated  the  application  of  modem  flight  control  system  design 
techniques  to  engine  control  system  design;  it  was  claimed  that  digital  control  systems  designed  in  this  way  would  enable 
full  performance  to  be  extracted  from  the  engine  without  the  constraints  normally  imposed  by  control  system 
limitations.  The  advantages  of  system  design  testing  by  simulation  were  stressed,  particularly  the  cost  savinp  from 
getting  the  design  right  at  the  earliest  possible  time.  This  was  an  impressive  and  well  presented  paper,  though  there  were 
those  who  felt  that  the  design  philosophy  advocated  might  lead  to  excessive  complexity. 

Rambach  (8),  in  spite  of  the  title  of  his  paper,  dealt  mainly  again  with  engine  control  system  design,  pointing  out  the 
need  to  separate  the  flight  critical  basic  control  elements  and  treat  them  differently  from  the  rest.  The  information 
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normally  available  within  a  modem  control  system  can  be  used  for  automatic  test  and  status  evaluation,  so  relieving  pilot 
workload. 

In  a  well  presented  paper  (9)  by  Seabridge  and  Edwards,  various  possibilities  for  integration  between  powerplant 
control  and  other  aircraft  systems  were  described,  with  concentration  on  integration  of  the  engine  and  its  control  system 
into  the  aircraft  utility  systems  architecture.  Techniques  for  integration,  practical  benefits  and  problems  were 
enumerated  in  a  realistic  way.  The  authors  also  pointed  out  the  inevitability  of  integration  of  engine  and  flight  control  in 
advanced  VSTOL  aircraft  using  thrust  vectoring. 

The  next  paper  (10)  was  presented  for  its  absent  author,  McNamara,  by  Seabridge.  It  described  the  design  concepts 
of  a  system  combining  engine  control,  powerplant  instrumentation,  and  data  communication  with  aircraft  systems  to  form 
an  integrated  engine  control  and  management  system.  It  took  the  principles  outlined  in  the  first  three  papers  of  the 
session  a  stage  further  towards  practical  design,  demonstrating  how  a  very  high  level  of  fault  tolerance  can  be  obtained  by 
making  maximum  use  of  redundancy  through  the  flexibility  of  digital  control  and  data  bus  management. 

The  last  paper  (1 1)  of  the  session  carried  the  progression  a  stage  further  with  a  discussion  by  Eccles  of  a  system 
under  development  for  the  AV8B  aircraft.  In  addition  to  the  engine  control  its  integration  with  flight  control  was  also 
dealt  with,  showing  how  major  performance  improvements  could  be  secured. 

This  was  an  excellent  session,  with  all  the  papers  reaching  a  high  standard.  It  was  unfortunate  that  the  schedule 
allowed  no  time  for  discussion  after  the  individual  papers,  but  a  period  at  the  end  of  the  session  provided  an  opportunity 
for  a  lively  exchange  of  views.  A  good  deal  of  attention  was  devoted  to  software  testing  and  integrity,  and  it  was 
interesting  to  find  the  speakers  feeling  that  the  problems  in  this  area  are  over-rated,  providing  that  careful  specification 
and  proper  procedures  are  followed. 

Session  III  —  Integration  of  Diagnostics,  Self-test  and  Built-in  Test  • 

The  possibility  of  using  a  common  set  of  inertial  sensors  to  meet  all  requirements  of  navigation,  fire  control,  flight 
control  and  other  systems  has  been  under  discussion  for  some  years,  and  paper  1 2,  by  Young  et  al.,  described  a  pioneer 
attempt  to  put  this  into  practice.  The  laser  ring  gyro  is  an  important  building  brick  for  this  purpose,  since  it  combines 
the  accuracy  required  for  navigation  and  the  wide  bandwidth  and  quick  warm  up  needed  for  flight  control.  This  was  an 
excellent  paper,  with  a  frank  description  of  the  problems  encountered  which  stimulated  a  lively  discussion  period. 

Perhaps  the  most  important  conclusion  was  the  need  to  bring  together  inertial  system  designers  and  flight  control  system 
designers  -  integrated  systems  need  integrated  design  teams! 

In  the  next  paper  (13),  McKinlay  set  out  to  consider  the  need  for  increased  integration  to  reduce  pilot  workload 
while  providing  greater  accuracy  in  three  dimensional  flight  path  control.  His  paper  demonstrated  once  again  the 
difficulty  in  finding  the  best  line  of  approach  to  meet  the  needs  of  ground  attack,  in  comparison  with  the  relative 
simplicity  of  the  air-to-air  combat  situation.  The  conclusion  seems  to  be  that  an  optimum  blend  of  automatics  and  pilot 
control  is  likely  to  yield  the  best  compromise  between  workload,  cost,  performance  and  flexibility. 

'A  diagnosis  scheme  for  sensors  of  a  flight  control  system  using  analytic  redundancy’  described  in  the  paper  ( 14)  by 
Stuckenberg,  is  an  attempt  to  use  software  to  reduce  the  need  for  redundancy  of  hardware  in  flight  critical  systems.  The 
success  or  failure  of  such  a  scheme  depends  essentially  on  practical  limitations,  and  flight  test  results  were  described. 

The  last  paper  of  the  session  ( 1 5),  by  Courtois  covered  the  design  of  an  integrated  system  of  maintenance,  in  which 
built  in  test  is  managed  and  recorded  by  the  central  computer  via  the  data  bus.  Thus  low  level  testing  can  be  interleaved 
with  operational  use,  with  the  test  record  available  on  landing  The  advantage  of  testing  under  flight  conditions  should 
help  to  remove  that  maintenance  bugbear,  the  fault  which  only  manifests  itself  in  flight.  The  following  discussion 
indicated  a  strong  interest  in  this  paper. 
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Cooperation  between  AGARD  Panels  was  apparent  when  Prof.  Jacques  of  the  Propulsion  and  Energetics  Panel,  .  | 

took  the  chair  for  this  session.  Unfortunately  it  was  also  at  this  point  that  the  symposium  was  most  seriously  affected 
by  the  problems  already  referred  to,  for  not  only  were  4  papers  withdrawn  from  the  last  two  sessions,  but  also  there  were 
no  preprints  available  for  3  of  the  surviving  papers,  and  no  paper  appears  in  the  Proceedings  for  2  of  them,  with  a 
consequent  impact  on  the  quality  of  this  report. 

Paper  16,  Design  Methods  for  Integrated  Flight/Propulsion  Control  Systems  by  Skira  and  Small,  AFWAL/POTC, 

Wright-Patterson  AFB,  Ohio,  USA,  noted  the  trend  which  will  lead  to  future  fighter  aircraft  being  required  to  have  a  wide 
range  of  capabilities  to  deal  with  a  variety  of  different  types  of  mission  and  situation.  This  requirement  for  versatility, 
they  considered,  is  likely  to  lead  to  the  use  of  two  dimensional  thrust  vectoring  and  reversing  nozzles  to  obtain  better  low 
speed  manoeuvrability,  and  variable  cycle  engines  for  faster  thrust  response  and  freedom  from  stall  problems.  Flight 
control,  inlet  control  and  engine  control  will  all  be  linked  by  an  overall  feedback  loop,  with  the  pilot  operating  a  compre¬ 
hensive  manoeuvre  command  control,  designed  to  make  the  control  loop  transparent  to  the  pilot.  In  response  to  a 
question  on  the  difficulty  of  pre-flight  validation  of  such  a  system,  the  answer  was  by  a  comprehensive  programme  of 
simulation  and  rig  testing. 
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In  the  only  paper  in  the  programme  deailing  with  systems  for  civil  aircraft,  Wuest  (18)  described  a  system  designed 
for  flight  economy  in  the  Airbus,  providing  automatic  control  to  achieve  specified  profiles  of  speed  and  height  rate, 

Pattinson  (19)  presented  an  aircraft  designer’s  view  of  engine/flight  control  system  integration,  as  applied  to  a  future 
VSTOL  fighter.  Postulating,  like  other  speakers,  a  manoeuvre  demand  control  over  all  components  of  acceleration,  he 
anticipated  benefits  in  performance  from  the  resulting  freedom  from  the  need  to  design  the  aircraft  to  basic  handling 
criteria.  The  importance  of  thinking  out  the  interface  with  the  pilot,  and  of  adapting  thrust  priorities  to  the  flight 
regime,  were  clearly  brought  out.  This  was  a  challenging  paper,  and  brought  a  good  response  from  the  audience  in  a 
question  period  ranging  over  redundancy  philosophy,  the  man-machine  interface  and  computer  hardware  and  software 
design. 


Session  V  -  Integration  of  Fire  and  Flight  Control 

The  final  session  was  chaired  by  Mr  A’Harrah  of  the  Flight  Mechanics  Panel:  it  was  reduced  to  only  two  papers. 

Paper  20,  ’AFTI/FI6  Automated  Maneuvering  Attack  System  -  A  Concept  in  Combat  Automation'  by  Ramage, 
AFWAL/FII,  Wright  Patterson  AFB  and  Lydick,  General  Dynamics,  Fort  Worth,  Texas  described  a  system  designed  to 
operate  effectively  in  the  very  short  time  available  in  high  speed  low  level  flight  for  target  acquisition,  identification  and 
weapon  delivery  manoeuvres.  The  F-16  aircraft,  fitted  with  a  triplex  digital  flight  control  system  and  two  vertical  canards 
under  the  engine  intake  which  can  give  2  g  lateral  acceleration  in  a  flat  turn,  was  already  in  flight  test  at  Eglin  AFB,  this 
comprising  Phase  I  of  the  programme.  Phase  2,  the  Automated  Manoeuvring  Attack  System  (AMAS)  was  being  prepared 
for  flight  testing  in  Spring  1984;  its  main  features  were  a  FLIR/laser  target  acquisition  and  attack  sensor,  an  integrated 
flight  and  fire  control  system,  a  pilot's  voice  command  and  helmet  sight  system,  and  automatic  fuze  setting.  The 
gimballed  FLIR  sensor/tracker  would  provide  the  information  to  compute  lead  angle  error  and  line  of  sight  steering 
commands,  enabling  the  (light  control  system  to  make  an  automatic  attack  on  the  target.  The  following  control  law 
modes  will  be  selectable  by  the  pilot:  normal,  air-to-air  gunnery,  air-to-ground  gunnery,  air-to-ground  bombing.  To  ensure 
pilot  confidence  in  the  system  considerable  attention  is  being  paid  to  integrity  management,  including  built-in  test, 
carried  out  continuously  in  flight  where  necessary,  incorporation  of  multiple  operating  limits,  and  an  arrangement 
enabling  the  various  computers  in  the  system  to  test  one  another.  When  the  system  is  operating  automatically  its  inten¬ 
tions  are  depicted  to  the  pilot  on  the  head-up  display  (HUD). 

Answer  to  questions  elicited  the  following  further  information:  initial  target  acquisition  will  be  by  the  pilot  using 
either  the  helmet  sight  on  the  HUD:  whether  the  helmet  sight  could  be  successfully  used  under  g  was  as  yet  unproven. 
Voice  command  had  proved  very  useful  in  laboratory  simulation  to  insert  corrections  to  an  inaccurate  helmet  sight 
designation:  however,  voice  command  was  proving  much  less  successful  in  flight  because  of  the  effects  of  the  oxygen 
mask,  pilot  stress  etc.  In  order  to  provide  assurance  of  not  hitting  the  ground  the  radar  altimeter  has  360°  coverage  in 
roll,  and  latest  time  to  pull  up  is  continuously  computed  and  displayed.  Pilots  apparently  like  the  flat-turn  capability 
provided  by  the  canards  because  they  can  line  up  the  aircraft  more  rapidly;  they  are  not  likely  to  use  it  above  1  g.  In 
the  triplex  flight  control  system,  after  an  initial  failure  a  self  test  routine  is  initiated  which  allows  one  of  the  remaining 
two  channels  to  be  selected  for  use;  the  original  analogue  system  is  also  retained  as  a  back-up.  Danger  of  common  channel 
failure  due  to  the  use  of  common  software  can  be  averted,  it  is  hoped,  by  the  built-in  test,  in-flight  monitoring  and 
continuous  checking  of  the  safety  of  proposed  manoeuvres,  (Because  no  text  is  available  this  paper  and  No.  16  have  been 
reported  as  fully  as  possible  here.) 

The  final  paper  of  the  symposium  (2 1 )  by  Dang  Vu  and  Mercier  described  a  theoretical  approach  to  air  to  ground 
gun  aiming,  in  which  improvements  are  obtained  by  sophisticated  multivariate  processing  of  pilot  steering  commands. 

The  pilot  acts  essentially  as  an  estimater  of  aiming  errors,  using  the  control  stick  to  command  sight  line  velocity. 

Although  the  control  law  derived  is  essentially  non-linear,  a  simplified  linear  version  had  been  tried  in  simulator  tests 
with  some  success,  and  pilots  had  found  it  easy  to  control.  Separate  controls  might  become  necessary  if  pilots  found  it 
confusing  to  changeover  between  this  and  normal  flight  control. 


4.  AUDIENCE  REACTION 

The  symposium  was  attended  by  1 29  people,  and  the  generally  high  quality  of  the  question  periods  and  discussions 
suggested  that  the  majority  at  least  were  expert  in  some  part  of  the  field;  very  few,  however,  came  from  the  aeroengine 
industry. 


Questionnaires  were  completed  by  19  attendees;  their  responses  have  been  summarised  as  follows: 


Question 

Good 

Average 

Poor 

al  Quality  and  relevance  of  papers,  sessions  and  questions 

7 

8 

3 

a2  Did  the  papers  support  the  theme?* 

6 

11 

a3  Did  the  symposium  live  up  to  your  expectations?* 

11 

8 

bl  Views  on  operational  issues  snd  requirements 

3 

1 

6 

b2  Assessment  of  technology  (state  of  the  art) 

4 

3 

•But  there  were  many  complaint*  about  the  misting  papers. 

x 


The  response  to  question  a3  is  disappointing,  since  AGARD  symposia  are  usually  score  better  than  this;  moreover 
some  respondents  indicated  that  their  expectations  were  in  any  case  low.  However,  there  is  no  doubt  that  cancellation  of 
so  many  papers  was  very  strongly  resented  by  the  audience. 

Responses  to  questions  on  particular  technical  challenges  and  unresolved  problems,  while  giving  a  very  wide  range  of 
answers,  focussed  particularly  on  three  points.  First,  what  is  it  that  integrated  systems,  and,  it  might  be  said,  future 
aircraft  in  general,  are  really  required  to  do?  there  was  a  general  feeling  of  lack  of  definition  of  the  problem.  Second, 
the  correct  role  for  the  pilot  in  a  highly  automated  system  needs  much  more  consideration.  Third,  there  was  a  general 
consciousness  of  the  need  for  much  more  interdisciplinary  interaction  (particularly,  perhaps,  with  the  engine  and  human 
factors  experts  who  were  largely  absent  from  this  symposium). 


S.  TECHNICAL  APPRECIATION 

The  answers  to  question  bl  of  the  questionnaire  reflect  the  fact  that  we  are  in  a  period  of  considerable  uncertainty 
as  to  the  requirements  for  future  aircraft.  Is  a  high  degree  of  sophistication  in  the  aircraft  justified  for  the  better  delivery 
of  old  fashioned  weapons  such  as  bombs  and  cannon  fire?  Brodersen's  paper  (3)  demonstrated  that  a  certain  level  of 
integration  is  required  by  the  most  modem  weapons,  but  could  this  be  generalised  into  a  more  universal  requirement? 
The  technology  to  provide  major  improvements  will  clearly  be  available  over  the  next  few  years,  but  which  direction  to 
proceed  presents  a  real  problem;  the  thoughtful  paper  by  McKinlay  (13)  aired  some  aspects  of  the  problem,  but  came  to 
no  very  definite  conclusion.  Given  these  doubts  as  to  what  future  systems  may  be  aiming  to  do.  it  is  perhaps  not 
surprising  that  there  is  also  uncertainty  as  to  what  the  role  of  the  man  in  the  system  should  be.  Even  so,  there  are 
grounds  for  feeling  that  more  progress  could  be  made  in  defining  the  role  of  the  pilot  in  semi  specific  terms,  and  at  the 
detailed  level  there  should  be  scope  for  working  out  the  optimum  interface  with  speech  recognition  systems  and  other 
recent  developments.  More  man-in-the-future-cockpit  simulation  is  certainly  required. 

On  the  more  directly  technical  front  the  conference  did  very  well,  the  missing  papers  being  at  least  partially 
compensated  by  much  useful  discussion.  Almost  certainly  it  served  to  put  the  problems  of  digital  system  integrity  with 
a  better  perspective  for  many  of  those  attending.  The  importance  of  some  peripheral  areas  which  are  often  paid  little 
attention  in  the  formulation  of  the  original  system  concept,  but  are  nevertheless  vital,  was  well  demonstrated  by  the 
paper  on  integrated  maintenance  by  Courtois.  A  number  of  papers  dealt  impressively  with  the  design  of  systems  of  a 
relatively  high  level  of  integration,  and  in  particular  the  prospect  of  a  comprehensive  flight  control  system  for  VSTOL 
vectored  thrust  aircraft  in  which  engine  control  actions  are  treated  simply  as  components  of  flight  control,  provides  one 
promising  direction  for  future  progress 


6.  MILITARY-POTENTIAL 

As  has  been  indicated  already,  the  potential  military  benefits  of  integration  were  not  clearly  brought  out,  there  being 
a  general  taking  for  granted  that  more  integration  must  be  good.  Integration  can  be  applied,  however,  in  a  wide  variety 
of  different  ways,  and  the  military  and  the  scientists  and  engineers  need  to  evolve  clearer  perspectives  of  which  of  the 
wide  range  of  possible  benefits  should  be  aimed  for,  and  what  cost  would  be  acceptable.  There  can  be  no  doubt, 
however,  that  further  progress  in  integration  will  be  of  genuine  value  in  some  areas,  and  clearly  the  flight  control  of 
thrust  vectoring  aircraft  is  one  of  these ;  more  generally,  worthwhile  improvements  will  come  in  both  air-to-air  and  air-to- 
ground  combat,  but  the  best  way  to  obtain  them  has  yet  to  be  thought  out. 


7.  PRESENTATION  AND  ADMINISTRATION 

The  French  authorities  are  to  be  congratulated  on  the  local  organisation  of  the  meeting  and  the  facilities  provided; 
apart  from  very  minor  problems  with  busses,  everything  went  smoothly  and  efficiently.  As  with  meetings  in  most  large 
citifies,  delegates  were  scattered  over  many  hotels,  and  a  recommendation  of,  say  two  neighbouring  hotels  would  have 
helped  to  promote  social  activities  in  the  evenings.  The  Programme  Committee  undoubtedly  put  together  an  excellent 
programme,  had  it  survived  intact  it  would  probably  have  maintained  a  higher  general  levet  than  most  AGARD  symposia. 
Even  the  revised  programme  served  as  the  basis  for  what  was  undoubtedly  a  worthwhile  conference,  though  it  was 
unfortunate  that  the  rescheduling  did  not  allow  a  more  even  distribution  of  discussion  periods;  some  discussion  time  after 
every  paper  should  be  the  rule. 

8.  WITHDRAWAL  OF  PAPERS 

Although  those  attending  made  the  best  of  this  occasion,  any  repetition  of  a  large  scale  withdrawal  of  scheduled 
papers  is  likely  to  be  disastrous  for  AGARD,  for  the  word  would  soon  get  around  that  the  programmes  of  AGARD 
conferences  are  not  to  be  relied  upon,  and  there  is  no  shortage  of  travel  budget  cutters  who  would  exploit  that.  To  insist, 
as  many  delegates  suggested,  on  an  absolute  guarantee  of  all  papers  in  the  published  programme  would  probably  be  quite 
impracticable,  or  at  best  would  lengthen  the  process  of  preparation  to  a  degree  imccmpatible  with  fast  moving 
technology.  Undoubtedly  something  can  be  done  to  see  that  US  authors  produce  papers  more  in  line  with  their  censor’s 


requirements,  and  this  need  not  necessarily  reduce  their  value  to  a  symposium  -  it  is  not  so  much  technical  details  that 
are  appreciated  by  an  audience  as  arguments  for  and  against  different  courses  of  action,  descriptions  of  problems  and 
their  solutions,  etc.,  which  often  seem  to  be  quite  allowable.  Ultimately,  however,  it  must  fall  on  all  those  with  any 
possible  influence  on  US  policy  in  this  matter  to  attempt  to  make  it  more  compatible  with  an  alliance  of  free  nations, 
otherwise  not  only  AGARD,  but  in  the  end  NATO  itself  may  be  irreparably  damaged. 


9.  RECOMMENDATIONS 

(a)  In  spite  of  the  collaboration  of  the  Flight  Mechanics  and  Propulsion  and  Energetics  Panels,  there  was  little  evidence 
of  participation  from  experts  in  these  areas.  Possibly  AGARD  should  seek  means  of  achieving  better  interaction 
between  different  disciplines,  in  areas  of  common  interest;  if  this  had  been  the  only  Spring  meeting  for  all  three 
panels  a  better  cross  section  would  probably  have  been  observed  in  the  attendance. 

(b)  If  such  multi-disciplinary  participation  could  be  assured,  there  are  a  number  of  aspects  of  this  topic  which  many 
delegates,  and  1  share  their  views,  considered  worth  further  action;  in  particular  symposia  designed  to  bring  out 
the  broader  issues  of  where  greater  integration  will  really  be  justifiable,  and  to  deal  more  positively  with  the  human 
role  in  highly  integrated  systems  are  advocated. 

(c)  Attention  is  again  drawn  to  the  recommendations  contained  in  paragraph  7  above. 


II 
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SUMMARY 

^-System  integration  requires  extensive  use  of_digltal  data  processing.  Therefore, 
after  a  brief  glance  back  into  time, -Some  peculiarities  of  data  processing  will  be  - ■  < 
shown  in  mere  detail.  With  two  examples  the  paper  demonstrate  what  the  problems 

are  that  can  arise  with  a  totally  integrated  system  and  how  some  of  them  may  be 
avoided., 

1  INTRODUCTION 


In  its  course,  a  great  deal  is  sure  to  be  said  about  the  advantages  of  integrating 
/  the  individual  systems,  so  I  am  going  to  dispense  with  any  remarks  about  that  side  of 
the  business  and  do  some  reminiscing  instead.  The  result  will  help  you  see  that  data 
processing  alone  has  enabled  complex  systems  to  be  made  and  integrated.  Last  autumn, 
the  Avionics  Panel  held  a  symposium  on  Software  in  Avionics.  Addressing  that  symposium 
on  "Avionics  Software  -  the  State  of  the  Art",  Dr  W.  Ware  said  that  progress  in  hardware 
led  to  umpteen  percent  improvement  in  performance,  but  that  progress  in  data  processing 
enabled  performance  to  be  Improved  by  whole  orders  of  magnitude. 

I  should  like  to  stress  that  statement  and  assert  thet  progress  in  hardware  components 
is  for  the  most  part  achievable  only  when  data  processing  is  used  in  all  the  various 
individual  developments . 

Considering  the  magnitude  of  the  importance  attaching  to  data  processing,  and 
because  the  problems  that  can  crop  up  in  developing  software  are  frequently  underestimated 
by  subsequent  system  users,  I  shall  be  going  into  some  detail  in  the  second  part  of  my 
paper  on  software  and  its  peculiarities. 

I  shall  be  closing  with  a  pessimistic  example  of  what  the  problems  are  that  can 
arise  with  a  fully  integrated  system  and  a  few  hints  as  to  how  some  of  them  may  be 
avoided.  But  knowing  the  problems  does  not  mean  that  you  have  not  any  more!  Everybody 
probably  knows  the  problems  that  icy  roads  can  lead  to.  But  I  personally  do  not  know  of 
any  solution  -  except  the  obvious  one,  namely  staying  at  home  -  which  is  worth  its 
salt  (fig.  1). 

2  A  BRIEF  GLANCE  BACK  INTO  TIME 
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There  were  no  such  things  as  control  systems  when  military  aviation  began  (fig.  2): 

-  Heading  and  attitude  were  controlled  by  the  pilot  directly  through  the  stick 
and  his  pedals. 

-  The  engines  were  controlled  by  using  the  throttle  and  advancing  or  retarding 
the  spark. 

-  Fire  control  was  rule  of  thumb  on  the  part  of  the  crew  -  you  only  have  to  think 
of  the  first  bombing  raids. 

It  was  not  long  before  they  began  to  think  about  how  to  relieve  the  pilot  and 
crew  of  some  of  their  work  and  how  to  improve  the  probability  of  the  weapon’s  success. 

In  the  case  of  flight  control,  this  led  to  the  development  of  stabilisers,  heading 
controls,  and  dampers,  which  made  it  easier  for  pilots  to  hold  their  attitude  and  course 
and  improved  the  manoeuverablllty  of  aircraft.  Almost  simultaneously,  the  development  I 

of  the  autopilot  and  its  integration  in  the  flight  control  system  began.  That  led  to 
the  guidance  and  control  system,  to  be  found  nowadays  in  nearly  every  aeroplane. 

Fire  control  was  at  first  improved  with  fixed  sighting  devices,  which,  however, 
in  the  course  of  development  allowed  certain  parameters  (such  as  speed  and  croaswind) 
to  be  varied. 

Engine  control  was  at  first  -  when  aeroplanes  flew  with  piston  engines  -  similar  >’ 

to  engine  control  in  automotive  engineering,  out  more  complicated  due  to  the  different 
flight  levels  used.  Engine  control  of  modern  turbo  engines  is  a  more  complex  task,  done  '* 

by  the  fuel  control  unit,  which  has  to  consider  a  great  number  of  parameters.  But  this 
is  where,  as  demands  upon  the  engines  increase,  demands  upon  the  fuel  control  unit 
rise  considerably,  especially  in  respect  of  engine  handling.  It  has  to 

(1)  protect  the  engine  from  excessive  temperatures,  speeds,  and  pressures, 

(2)  ensure  rapid  acceleration  and  deceleration  without  any  faults  (flow  separation, 
pumping,  flame-out),  and 

(3)  ensure  that  thrust  is  always  directly  related  to  throttle  lever  position. 


Now,  after  that  brief  glance  at  the  individual  systeaa,  back  to  more  general 
mattera. 

Those  controls  were  all  analog  and  contained  mechanical,  hydraulic,  pneuaatlc, 
and/or  electric  components.  Since  at  least  flight  and  engine  control  have  to  be 
reliable  in  operation  -  their  failure  may  well  be  safety  critical  •,  there  was  a  limit 
to  their  complexity,  and  consequently  to  the  integration  of  the  individual  control 
systems. 

The  fact  that  fire  control  was  merely  mission  critical,  but  not  flight  critical, 
led  both  to  the  use  of  complex  control  units  such  as  mechanical  or  electric  analog 
calculators,  and  to  the  comparatively  early  employment  of  the  digital  technique:  after 
all,  failure  in  flight  was  not  critical. 

The  digital  technique  has  now  overcome  one  of  its  teething  troubles:  it  has  become 
very  reliable.  Another  advantage  is  the  tremendous  drop  over  the  past  few  years  in  the 
price  of  hardware  components.  Digital  computer  programmes  -  which  is  to  say  software  - 
make  it  possible  nowadays  to  have  associations  and  carry  out  functions  of  almost  unlimited 
complexity.  I  shall  be  going  into  their  reliability  a  little  later.  And  all  that 
makes  the  comprehensive  Integration  of  flight  control,  fire  control,  and  engine  control 
systems  possible. 

As  I  showed  at  the  beginning  of  my  paper,  the  use  of  data  processing  makes 
possible  boosts  in  performance  which  are  not  feasible  simply  by  improving  the  hardware 
components.  One  important  reason  is  that,  as  I  have  already  said,  very  much  more  complex 
associations  and  functions  are  possible.  That  realisation  should  not  be  allowed  to 
lead  to  the  stereotype  -  and  consequently  premature  -  decision,  "it  is  too  tricky  for 
hardware;  let  the  software  do  it”,  for  software  has  its  problems,  too  (fig.  3). 

3  DIGRESSION  INTO  DATA  PROCESSING 

Considering  the  Importance  of  software,  I  want  to  delve  a  little  into  its 
peculiarities,  specifically 

-  its  complexity, 

-  its  errors  and  its  reliability,  and 

-  its  development. 

At  the  same  time  I  am  going  to  try  and  correct  a  few  widespread,  but  false,  ideas, 
such  as  the  view  that  "software  is  cheap  to  make  and  easy  and  cheap  to  change".  In 
reality,  it  is  confoundedly  difficult  to  put  together  software  that  is  free  from  error, 
adequately  tested,  and  able  to  meet  all  that  is  demanded  of  it. 

3.1  THE  COMPLEXITY  OF  SOFTWARE 

One  of  the  reasons  for  the  widespread  assertion  that  software  is  cheap  is  the 
fact  that  the  complexity  of  software  is  vastly  underestimated  by  the  majority  of  software 
uners.  If  you  compare  software  with  hardware  (fig.  4),  you  should  always  keep  in 
mind  that  a  programme  (actually  quite  a  small  one;  consisting  of  10,000  machine  code 
Instructions  (which  is  about  2,000  to  3,000  HOL  instructions)  is  equivalent  to  circuitry 
consisting  of  about  10,000  circuits.  Whilst  the  software  is  apparently  easy  to  survey 
as  a  listing,  when  the  hardware  is  made  up  of  individual  components  the  expense  becomes 
discernible  by  the  extent  alone  (roughly  200  plug-in  cards) I 

3.2  SOFTWARE  ERRORS/SOFTWARE  RELIABILITY 

There  is  a  fundamental  difference  between  software  and  hardware  errors.  There 
are  no  signs  of  wear  and  tear  or  fatigue  in  software.  Software  errors  are  in  a 
programme  right  from  the  beginning,  but  they  only  come  to  light  when  the  programne  route 
containing  the  false  instructions  is  run.  Even  then,  however,  it  is  not  certain  that 
the  error  will  emerge  if  its  effect  is  too  slight  in  respect  of  the  current  feed-in 
conditions.  There  are  examples  of  errors  that  have  been  in  programmes  for  years  on  end 
without  being  discovered  simply  because  the  deviations  in  the  final  results  have  been 
too  small.  Fundamentally,  the  same  problem  exists  in  the  case  of  hardware,  especially 
if  the  hardware  is  complex.  But  software  is  complex  almost  by  its  very  nature,  so 
that  this  problem  is  never  missing. 

Let  me  give  you  a  small  example.  A  computer  with  fixed  comma  arithmetic  had  to 
work  out  the  sln/cosin  value  of  angles  measured  with  sensors.  It  was  overlooked  that 
the  scales  used  with  the  individual  attitude  angles  were  not  identical,  and  the  result 
for  one  angle  was  the  wrong  sin(2x)  Instead  of  the  right  one  (x).  That  error  remained 
undetected. until  the  factor  containing  the  term  should  have  assumed  its  maximum  value 
(at  x  -  90°),  but  showed  0  (sln180°  «  0). 

But  to  get  back  to  the  general  facts  about  software  errors. 

We  can  make  these  distinctions  (fig.  5) 

(1)  Systems  errors  in  design  and 

(2)  programing  errors. 
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In  the  case  of  system  errors  In  design,  the  mathamatics  and  logic  with  which  the 
problea  is  described  ana  solved  contain  an  error  or  errors.  These  are  often  traceable 
to  difficulties  of  wording  and  understanding,  both  in  describing  the  problea  and  in 
specifying  the  systea. 

In  the  case  of  prograam4,y  “-^rs.  one  can  again  draw  a  distinction  between 

(1)  errors  on  the  part  of  the  prograaaer  and 

(2)  compiler  errors. 

Whilst  in  the  case  of  (1)  the  prograaaer  puts  down  wrong  Instructions,  so  that 
his  prograaae  does  not  fulfil  the  systea  specification,  in  the  case  of  (2)  the  programme, 
written  in  a  higher  prograaae  language,  tallies  with  the  systea  specification,  whilst 
the  controllable  machine  code  coop lied  by  the  coapller  does  not.  This  error,  of  course, 
can  be  traced  again  to 

-  a  systea  design  error  or 

-  a  programing  error 

in  coaplllng. 

What,  then,  can  be  done  to  enhance  the  reliability  of  systeas  containing  software? 

-  You  can  try  to  eliminate  errors. 

-  You  can  try  to  tolerate  errors;  for  instance  by  having  redundant  ayateas  in 
the  software  as  well.  (If  you  do  that,  the  reliability  of  a  duplex  systea  Bust 
be  calculated  on  fig.  6b  and  not  fig.  6a.) 

But  there  is  another  property  which  enhances  the  reliability  of  software,  and 
that  is  robustness.  By  that  I  mean  that  the  software  concerned  is  capable  of  standing 
up  to  untoward  events,  such  as  feeding  in  data  outside  the  specification. 

3.3  THE  DEVELOPMENT  OF  SOFTWARE 

I  am  sure  what  I  have  Just  been  saying  sounds  very  nice.  But  the  question  is, 
how  can  it  be  used? 

To  answer  it,  let  us  take  a  closer  look  at  the  genesis  of  software.  Broken  down 
only  very  roughly,  it  looks  something  like  this  (fig.  7): 

-  In  the  first  Instance,  there  is  only  a  verbal  description  of  the  problem  (which 
is  to  say  the  system  planned). 

-  Ihat  verbal  description  has  to  be  converted  to  a  mathematical/logical  description 
(say  specification). 

-  On  the  basis  of  that  specification,  taking  in  a  few  intermediate  steps  which  I 
am  not  going  to  discuss  at  this  Juncture,  the  programme  is  draughted  and  written 
(encoded)  and  tested. 

-  Finally,  the  software  is  Integrated  with  the  hardware  and  the  whole  system  is 
tested. 

As  you  will  have  learned  from  literature  on  the  subject  (fig.  8),  only  about  a 
quarter  to  a  third  c£  the  errors  in  software  are  traceable  to  errors  on  the  part  of  the 
programmer,  which  it  to  say  to  errors  which  arise  in  converting  the  specification  (i.e. 
the  mathematical /logical  requirement)  to  the  code.  Seventy- five  percent  of  such  errors 
come  to  light  before  the  final  test  phase.  In  this  sphere,  the  rnxsber  of  aids  to 
proving  agreement  between  specification  and  code  is  continually  growing.  But  most  of 
the  errors  (about  two  thirds  to  three  quarters)  are  systea  designing  errors,  which  is 
to  say  they  crop  up  in  converting  the  verbal  requirement  to  the  mathematical/logical 
specification.  And  seventy-five  percent  of  these  errors  remain  undetected  until  the 
final  test  phase  or  even  the  service  phase.  That  is  where  alda  are  lacking,  and  I 
doubt  whether  there  ever  will  be  any.  The  main  problem,  one  that  will  continue  into 
the  future  (and  not  only  in  respect  of  software),  is  "how  can  it  be  demonstrated  that 
the  mathematically  and  logically  precise  description  (which  is  to  say  the  specification) 
of  the  project  system 

(1)  is  correct, 

(2)  covers  all  eventualities,  and 

'  (3)  tallies  precisely  with  what  the  user  wants?" 

But  let  us  get  back  to  the  subject  of  this  symposium. 

4  INTEGRATED  SYSTEMS 

In  a  modem,  high-performance  military  aeroplane"-  take  the  MRCA/Tomado,  for 
Instance  -  the  two-man  crew  have  their  hands  full  with 

-  flight  control, 

-  navigation, 

-  fire  control,  and 

-  keeping  an  eye  on  the  terrain  they  are  overflying  and  their  environment. 
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If  all  that  had  to  be  done  by  one  man  alone,  he  would  be  overtaxed,  and  the  success 
of  the  mission  would  be  very  doubtful.  But  the  second  Ban  in  the  cockpit  needs  a  great 
deal  of  room,  his  own  supply  and  rescue  system,  and  his  own  displays  and  controls.  And 
that  increases  the  deadweight  of  such  an  aircraft  by  sooe  few  hundreds  of  kllograamea. 

That  Increase  in  room  and  weight  means  more  powerful  engines  with  a  greater  fuel 
consumption,  which  in  turn  means  that  more  fuel  has  to  be  carried.  And  all  that  means 
that  a  two-seater  aeroplane  cannot  be  below  a  certain  size  if  it  is  to  have  the 
required  radius  of  action  in  the  operational  conditions  laid  down.  So  user  demands 
for  small  aircraft  with  a  low  fuel  consumption  can  hardly  be  met.  However,  in  the  light 
of  the  worldwide  oil  crisis  such  demands  are  becoming  more  and  more  frequent.  Not¬ 
withstanding  the  difficulties  involved,  technological  progress  in  recent  years  makes 
it  possible  to  come  a  little  closer  to  meeting  them: 

Attempts  are  being  made  to  automate  as  far  as  possible  individual  systems,  and 
consequently  the  overall  system,  always  leaving  the  final  decision  to  the  pilot.  Such 
automation,  however,  calls  for  an  integrated  system  (fig.  9),  since  an  automatic  attack, 
for  instance,  is  feasible  only  when  a  fire  control  system  sensor  has  acquired  a  target 
and  the  guidance  and  control  system  and  perhaps  the  engine  control  system  are  so  governed 
that  the  aeroplane  automatically  holds  a  heading  consonant  with  the  engagement  of  the 
target.  In  a  weapon  system  of  that  kind  the  pilot  -  depending  upon  the  flight  phase  - 
can  devote  himself  to  the  main  task,  be  it  flying  the  aeroplane,  using  the  weapons,  or 
watching  a  display.  This  lessening  of  the  burden  upon  the  pilot  is  a  decisive  requirement; 
after  all,  investigations  have  shown  that  roughly  seventy  percent  of  the  flying  accidents 
that  have  taken  place  in  recent  years  have  been  due  to  pilot  stress. 

Now,  there  I  have  pointed  to  two  Important  reasons  for  integrating 

-  the  flight  control/flight  guidance  system, 

-  the  fire  control  system,  and 

-  the  engine  control  system. 

They  are  (fig.  10) 

(1)  relieving  the  pilot  of  some  of  his  work,  especially  in  single-seaters,  and 

(2)  the  Improvement  of  overall  systems. 

However,  integration  is  also  governed  by  certain  parameters,  such  as 

(1)  good  serviceability  and  testability, 

(2)  ease  of  Integration  with  regard  to  new  weapons  and  equipment,  and 

(3)  the  use  of  known  standards,  such  as 

-  the  Data  Bus- ST AN AG  3838  (  -  MXL-ST&-1553  B)  and 

-  Aircraft/Stores  Electrical  Interface  STANAG  3837  (-  MIL-STD-1760). 

To  wind  up  this  paper,  I  want  to  show  you  where  I  see  the  limits  of  Integration 
and  how  I  think  integration  should  be  accomplished. 

A.  1  THE  LIMITS  OF  INTEGRATION  (fig.  11) 

If  you  want  to  design  an  integrated  system  to  the  optimum  by  which  I  mean  so  that 
it  always  behaves  in  the  best  possible  way  -  for  Instance  with  regard  to 

-  weapon  effect, 

-  fuel  consuag>tion, 

-  pilot  stress,  and 

-  survivability, 

you  can  only  do  so  by  taking  integration  into  account  right  at  the  beginning,  in  the 
earliest  design  phases,  which  is  to  say  by  establishing  all  the  control  laws  in  accordance 
with  the  ultimate  design.  That  also  -  and  especially  -  means  that  the  overall  system 
has  to  be  optimallsed  with  all  its  control  laws.  There  is  no  doubt  that  such  a  system 
can  be  developed,  but  it  is  going  to  be  very  extensive  and  complex.  I  do  not  Intend  to 
go  into  any  detail  at  all  on  the  difficulties  that  would  attend  its  development. 

For  the  sake  of  simplicity,  let  us  assume  that  such  a  system  exists,  and  that  it 
is  used;  consequently,  it  must  be  maintained  and  serviced.  Before  and  after  missions, 
you  have  to  find  out  whether  a  sub-system  or  a  piece  of  equipment  is  defective.  The 
more  cong>lex  the  system  is,  the  more  difficult  your  Job  is  going  to  be.  That  applies 
in  particular  when  you  have  to  find  the  cause  of  the  error,  even  though  the  effect  is 
known:  is  the  error  to  be  found  In  unit  X,  in  the  coupling  with  unit  Y,  or  is  it  merely 
due  to  the  fact  that  several  items  are  at  the  edge  of  the  admissible  tolerance? 

Another  thing  to  be  considered  is  that  the  requirement  for  testability  is  going 
to  increase  the  complexity  of  the  entire  system  and,  consequently,  reduce  its  reliability, 
since  it  is  not  only  in  the  system  itself  that  errors  exist  or  can  occur;  they  can 
also  be  present  in  its  monitoring  and  testing  elements. 

We  can  sun  up  by  saying  that  a  "totally  integrated"  system  will  certainly  not 
meet  the  Justifiable  demand  of  the  user  for  good  serviceability  and  testability. 

But  such  a  system  will  not  only  be  used;  the  time  will  come  when  it  will  have 
to  be  modified  -  to  integrate  a  new  weapon,  for  Instance.  If  you  want  to  ensure  that 
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the  system  behaves  optimally  at  all  times  with  this  new  weapon  as  well,  you  have  to  re¬ 
engineer  the  control  laws  of  the  entire  system.  It  may  even  be  necessary  to  use  other 
'pproxi nation  procedures  if  the  required  real  time  behaviour  cannot  otherwise  be  maintained 
(for  example  the  frequency  with  which  the  necessary  parameters  are  updated).  It  will 
probably  be  necessary  to  rewrite  a  large  amount  of  the  pertinent  software.  And  amendments 
to  software  are  beset  by  the  unpleasant  fact  that  each  one  may  quite  unintentionally  inject 
new  errors  into  the  programme  (or  cause  errors  already  present,  but  thus  far  dormant, 
to  take  effect).  You  may  think  that  sounds  pessimistic,  but  anybody  who  has  had  anything 
to  do  with  software  and  its  amendment,  I  am  sure,  will  agree  with  me.  Changes  in  software 
is  the  very  sphere  where  Sod's  (Murphy's)  law  comes  into  its  own:  if  anything  can  go 
wrong,  it  will! 

Since  this  rather  gloomy  example  is  concerned  with  a  totally  integrated  system,  we 
cannot  rule  out  effects  upon  the  basic  flight  control  system.  And  in  that  case  the 
licensing  authority  will  call  for  the  aircraft  to  be  relicensed  -  after  passing  all  the 
pertinent  tests.  Let  us  not  look  at  how  difficult  that  is  with  such  a  complicated 
system.  Here  again,  we  can  sum  up  by  saying  that  a  "totally  integrated"  system  will  not 
meet  the  Justifiable  demand  of  the  user  for  the  easy  integration  of  new  weapons  and 
equipment  (fig.  12). 

That  means  that  two  important  parameters  demanded  by  the  user  are  not  met:  only 
the  requirements  for  pilot  relief  and  the  Improvement  of  the  overall  system  have  been 
taken  care  of.  The  third  parameter,  the  use  of  known  standards,  may  be  fulfilled,  but 
in  this  case,  apart  from  the  simplification  of  the  electrical  and  logical  Integration 
of  the  hardware,  it  offers  none  of  the  advantages  hoped  for.  So  integration  must  not 
be  practised  in  the  way  this  example  portrays  it. 

A. 2  REASONABLE  INTEGRATION  (fig.  13) 

There  is  not  the  slightest  intention  underlying  the  example  (I  have  Just  given) 
to  bedevil  integration.  But  to  my  way  of  thinking  you  have  to  exaggerate  if  you  want 
to  bring  the  necessary  emphasis  to  bear  on  the  problems  that  can  beset  it.  And  that  was 
the  only  intent  of  the  example. 

There  is  no  doubt  that  integration  is  a  sensible  aim,  provided  that  it  is  prosecuted 
in  such  a  manner  that  it  remains  controllable.  In  my  view  that  means  that  you  have  to 
try  to  design  each  system,  for  Instance 

-  guidance  and  control, 

-  navigation, 

-  fire  control,  and 

-  engine  control, 

to  the  optimum  and  give  it  an  electrically  and  logically  clearly  defined  interface  through 
which  It  can  transmit  commands  to  the  other  individual  systems  or  receive  commands  from 
them.  That  means  in  particular  that  standards  are  used  wherever  possible  for 

-  data  transmission  in  and  between  the  subsystems  as  per  STANAG  3838, 

-  aircraft/store  interface  as  per  STANAG  3837,  and 

-  programming  -  here  a  standardised  high  order  language;  for  Instance  Ada. 

One  system  (fire  control  for  example)  then  controls  the  others  by  transmitting 
command  signals  through  the  defined  interface  to  the  others  (guidance  and  control  for 
instance).  The  Individual  system  receiving  a  command  then  determines  whether  it  can 
be  carried  out,  or  is  admissible,  which  would  certainly  not  be  the  case  if  the  fire 
control  system  in  an  aircraft  flying  at  600  knots  ground  speed  and  an  altitude  of  a 
thousand  feet  wanted  to  have  a  45°  dive  to  bring  the  weapon  to  bear  on  target.  In  such 
a  case,  the  flight  control  system  must  report  back,  "No;  only  dive  angles  below  20° 
possible”.  That,  of  course,  may  mean  that  the  weapon  cannot  be  used.  That  example 
will  show  you  that  the  flight  critical  systems  (in  particular  the  flight  control  system, 
but  the  engine  control  system  as  well)  have  to  have  a  "veto",  which  can  report  back  and 
so  bring  about  changes  to  the  commands  transmitted  by  the  "requesting  individual  system". 

Now,  let  us  take  a  look  at  maintenance  and  service  in  this  case,  too.  Since  the 
individual  subsystems  of  the  weapon  system  are  connected  together  through  logically 
well  defined  interfaces,  it  is  very  much  easier  to  trace  errors  to  specific  subsystems. 
Since,  however,  errors  are  to  be  localised  if  at  all  possible  at  LRU  level,  the  sub¬ 
systems  themselves  have  to  be  very  carefully  designed  to  meet  this  requirement  for  good 
serviceability. 

But  let  us  return  to  the  example  of  subsequently  integrating  a  new  weapon.  What 
has  to  be  done  in  an  Integrated  system  of  this  kind?  In  this  case,  the  fire  control 
system  alone  has  to  be  modified  (and  that  little  word  "alone"  does  not  mean  that  it  is 
going  to  be  a  simple,  cheap  modification! ) .  Commands  issued  to  the  other  individual 
systems  still  go  out  through  the  well  defined  interfaces.  So  no  changes  are  necessary 
in  the  other  systems.  Such  an  aeroplane  will  therefore  not  lose  its  general  licence, 
which  -  after  the  requisite  tests  have  been  carried  out  -  will  merely  have  to  be 
extended  to  cover  the  new  weapon.  The  complexity  of  the  modification  here,  then, 
depends  mainly  upon  the  complexity  of  the  various  subsystems. 
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There  is  another  advantage  of  such  a  system  that  I  would  like  to  touch  on  briefly, 
and  that  is  that  a  considerable  amount  of  the  cost  of  development  and  testing  can  be 
saved  by  real  time  simulation  (where  appropriate  as  hardware-in- the-loop  simulation). 

Such  simulation  is  much  easier  if  you  begin  by  simulating  the  individual  systems.  With 
step-by-step  integration  of  the  individual  systems  through  well  defined  interfaces 
you  can  go  over  to  simulating  the  entire  system.  Here  again,  modifying  a  single  subsystem 
will  in  general  have  no  effect  upon  the  other  subsystems.  The  only  exception  is  where 
the  interfaces  have  to  be  modified;  in  that  case,  however,  the  original  system  would 
not  meet  the  parameters  I  have  severally  referred  to. 

To  sum  up  (fig.  14),  then,  it  may  be  said  of  an  integrated  system  consisting  of 
optlmalised  subsystems  coupled  together  through  electrically  and  logically  well  defined 
interfaces  that  it  will  probably  not  meet  the  user  requirement  for  pilot  relief  and 
overall  system  optimisation  quite  so  well  as  a  "totally  integrated"  system,  but  that  it 
possesses  the  decisive  advantage  of  being  able  to  meet  the  user  parameters  of 

-  good  serviceability  and  testability, 

-  easily  Integrated  new  weapons  and  equipment,  and 

-  the  use  of  known  standards, 

provided  that  its  subsystems  meet  that  requirement. 

5  CLOSING  REMARKS 

In  the  examples  I  have  given  you,  I  have  demonstrated  what  problems  can  occur  with 
integrated  systems  and  how  you  can  get  around  them.  EVen  an  Integrated  system  consisting 
of  optlmalised  systems  connected  together  through  well  defined  interfaces  must  be  very 
carefully  analysed  and  designed.  As  I  have  already  said,  knowing  the  problems  does  not 
mean  that  you  know  the  solutions  as  well! 

Looking  back  at  our  two  examples,  let  me  ask  a  purely  rhetorical  question.  Which 
of  these  two  weapon  systems  can  be  better  handled  by  a  user: 

-  one  that  is  totally  integrated,  using  standards,  or 

-  one  that  is  integrated  through  well  defined  interfaces  which  do  not  conform  to 
any  standards? 

I  hardly  think  it  is  possible  to  reach  a  decision  on  that  point.  Esther  weapon 
system  will  give  the  user  a  very  bad  headache.  The  conclusion  is  that  standardisation 
and  intelligent  integration  gives  a  user  advantages.  One  without  the  other  la  not  enough. 

Before  I  close,  I  went  to  say  a  few  words  about  a  matter  which  has  no  direct  bearing 
on  the  integration  of  individual  systems:  namely,  the  multi-uae  of  sensors.  The 
individual  control  systems  all  call  for  a  knowledge  of  certain  environmental  data,  such 
as 

-  atmospheric  pressure  (pilot  and  static), 

-  the  angular  rates  of  the  aircraft,  and 

-  the  attitude  of  the  aircraft. 

Here,  there  is  a  possibility  of  using  the  data  from  one  sensor  in  several  control 
systems,  whether  as  master  sensors  or  as  redundant  sensors.  This  field  of  multi-using 
sensors  is  another  field  which  has  to  be  very  carefully  analysed  when  the  system  is 
designed,  since  it  frequently  happens  that  the  various  control  systems  call  for  differing 
degrees  of  precision  and  failure  behaviour.  The  high  degree  of  precision  demanded  by  the 
fire  control  systems  must  not  be  allowed  to  result  in  having  several  highly  accurate  - 
and  consequently  expensive  -  strapdown  platforms  in  a  single  overall  system.  In  such  a 
case  it  is  quite  certainly  cheaper  simply  to  have  one  in  the  fire  control  system  and  to 
give  the  flight  control  its  own,  less  expensive  sensors,  and  to  use  the  platform  data 
there  at  the  most  as  a  back-up  (for  Instance  in  deciding  which  of  the  channels  is 
defective;. 

I  hope  I  have  made  it  clear  to  you  that  systems  of  well-nigh  unlimited  complexity 
can  be  created  by  using  digital  technique.  But  the  cost  of  such  systems  is  out  of  all 
proportion  to  their  degree  of  complexity. 

Our  task  in  future  will  be  to  look  for  a  reasonable  compromise  between  the 
understandable  wishes  of  users  and  what  is  financially  and  technologically  feasible.  We 
do  not  want  the  next  generation  of  NATO  military  aircraft  to  consist  of  mechanised, 
armed  hang  gliders  (fig.  15),  simply  because  there  are  not  enough  funds  to  pay  for 
other  systems  in  the  requisite  numbers,  although  hang  gliders  meet  a  few  important 
requirements,  such  as 

-  a  wide  radius  of  action, 

-  a  short  take-off  and  landing  capability,  and 

-  a  very  small  radar  cross-section. 
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-The  conventional  approach  to  weapons  for  ^eirv^CAS/BIy  miss  ions  has  not  provided  NATO 
forces  with  affordable!  effective  firepower  of  the  order  required  to  defeat /sWA/IfP 
armored  thrusts.  The  conventional  approach  has  led  to  weapons  that  are  either  too 
expensive  for  stockpile  -err'K?  and  training  purposes  or  too  expensive  to  go  to  war.  It 
has  also  failed  to  provide  NATO  strike  aircraft  assigned  to  CAS/BI  missions  with 
the  ability  to  achieve  a  large  number  of  kills  per  pasa  or  kills  per  sortie.  The  HVM 
concept  integrates  current  and  emerging  FCS  technology  with  a  low-cost,  lightweight 
missile  to  provide  NATO  forces  with  a  significant  firepower  improvement.  The  u/s«*  Air 
Force  has  completed  a  series  of  ground-launched  flight  teats  that  have  successfully 
resolved  all  technical  issues  critical  to  missile  guidance,  control  and  accuracy 
questions.  This  series  of  successful  demonstrations  permits  immediate  continuation 
into  an  air-launch  flight  test  environment  to  demonstrate  the  integration  of  the  three 
critical  elements  —  the  aircraft,  the  FCS,  and  the  missile.  <^-7 


1.0  INTRODUCTION 

The  Soviet  Army  (SA)  and  its  Warsaw  Pact  (WP)  allies  have  been  provided  with  an  awesome 
array  of  combat  and  support  vehicles  (See  Figure  1).  The  SA  strategists  and  tacticians 
rely  on  the  precepts  of  (1)  aggressive  mobility  through  extensive  use  of  mechanised 
infantry  and  associated  support  equipment /vehic les ,  (2)  use  of  their  quantitative 
advantage  to  generate  massed  armored  assault  forces  for  offensive  thrusts  and, 
(3)  heavily  structured  plans  to  integrate  the  mobility  of  forces  with  the  "punch”  of 
massed  firepower. 

The  Soviet  and  Warsaw  Pact  threat  is  both  dynamic  and  responsive.  Traditionally, 
the  tactical  forces  of  the  Soviet  Union  and  its  WP  allies  have  been  cast  in  a  role  of 
overwhelming  numerical  superiority  over  NATO  forces,  both  in  the  air  and  on  the 
ground.  NATO  has  attempted  to  compensate  by  developing  technological  superiority  in 
both  anti-vehicular  weapons  and  in  armor  protection  of  NATO  vehicles.  However,  the 
Soviet  Union  is  aggressively  pursuing  similar  technology  advancements  for  its  forces 
while  maintaining  high  production  rates  for  tanks,  support  vehicles,  and  artillery. 
The  obvious  intent,  and  unfortunate  result,  is  to  ensure  continued  numerical 
superiority  and  to  minimise  the  effects  of  NATO  technical  advancements. 

The  current  U.S.  response  is  production  of  new  strike  aircraft  (F-16  and  A-10), 
improvements  in  the  MAVERICK  missile,  and  development  of  the  LANTIRN  fire  control 
system  (FCS)  by  the  Air  Force;  development  of  the  new  M- 1  Main  Battle  Tank,  the 
advanced  attack  helicopter  ( AAH ) ,  and  a  new  anti-vehicular  missile  ( HELLF1RE )  for  the 
AAH  by  Che  Army.  The  two  major  deficiencies  in  this  response  are:  (1)  the  weapons  are 
oriented  towards  improved  performance  against  current  Soviet  armor  and  will  experience 
degraded  performance  against  future  Soviet  armor,  and  (2)  current  U.S.  weapon  systems 
(including  the  aircraft/helicopter  launch  platform)  have  the  capability  to  attack  a 
limited  number  of  targets  due  to  both  cost  and  carriage  (load-out)  constraints.  This 
response  and  related  deficiencies  are  typical  of  the  activities  within  RATO. 

NATO  forces  need  a  tactical  weapon  system  capability  to  defeat  the  SA/WP  massed 
armored  assault  forces  of  the  post-1990  era.  To  meet  this  challenge,  the  weapon  system 
must  be  effective  against  future  armored  vehicles;  the  weapon  must  permit  high  load-out 
of  aircraft  so  that  the  massive  number  of  targets  can  be  serviced  with  a  minimum  number 
of  aircraft  sorties;  the  weapon  must  be  low  in  cost  so  that  NATO  forcas  can  afford  the 
number  required  to  defeat  this  array  of  targets;  and  the  weapon,  or  its  varianta, 
should  be  adaptable  to  launch  platforms  of  all  NATO  forces  (ground  and  air)  that  have  a 
role  in  the  anti-vehicle  mission.  Such  a  weapon  system  would  be  a  true  force 
multiplier  that  could  provide  NATO  a  valid  non-nuclear  deterrent.  The  U.S.  Air  Force 
is  now  in  the  process  of  demonstrating  this  capability  with  the  Hypervelocity  Missile 
(HVM)  concept. 

2.0>  CONVENTIONAL  APPROACH 

2 .  1  Historical : 

The  current  approach  for  using  tactical  aircraft  for  the  Close  Air  8upport  (CAS) 
and  Battlefield  Interdiction  (BI)  missions  can  be  traced  to  World  War  1.  Through  World 
War  II,  the  Korean  Conflict,  the  Southeast  Asian  involvement,  and  the  Arab-Israeli 
clashes;  technology  has  provided  continually  improved  aircraft  and  weapons  but  the 
basic  operational  approach  has  not  undergone  a  major  change.  Through  the  Korean 


Conflict,  tactical  aircraft  attacked  ground  vehicle  targets  with  unguided  "iron  bombs" 
and  aach inegun/ cannon  fire.  Historical  data  through  that  period  reveals  that  4 , 500  Kg 
and  10,000  Kg  of  "iron  boab"  ordnance  was  required  to  kill  truck  and  tank  targets, 
respectively.  This  level  of  sortie  inefficiency  explains  the  fact  that  aodern  tactical 
aircraft  are  still  equipped  with  cannon.  It  also  has  provided  the  post-Korea  era 
iapetus  to  develop  accurate  guided  weapons  to  hit  targets  and  aircraft  fire  control 
systems  to  find  and  direct  fire  on  targets. 

2.2  Current : 

Technology  today  allows  tactical  aircraft  to  perform  the  CAS/BI  missions  with 
modern  weapon  systems  ( a i r c ra f t / f i re  control  system/missile)  that  significantly  improve 
sortie  efficiency  in  comparison  to  the  historical  data.  However,  the  massive  number  of 
targets  and  limited  number  of  aircraft  resources  drive  one  to  the  important  question  of 
whether  or  not  the  improvement  is  adequate.  Critical  factors  prevent  the  desired 
answer  with  current  and  emerging  weapon  systems:  (1)  The  physical  and  operational 
characteristics  of  modern  guided  weapons  will  not  permit  tactical  aircraft  to  achieve 
large  numbers  of  kills  per  pass  or  kills  per  sortie,  (2)  the  cost,  physical,  and 
operational  characteristics  of  modern  guided  weapons  have  a  major  detrimental  impact  on 
the  number  of  weapons  available  for  training  and  war  and  on  the  demands  placed  on  the 
FCS.  These  demands  reflect  the  need  to  ensure  that  the  few,  expensive  weapons 
available  in  a  sortie  are  used  to  maxisum  effectiveness.  These  same  factors  are 
equally  true,  in  an  analogous  manner,  of  weapons  sytems  for  NATO  ground  forces  which 
share  the  responsibility  of  defeating  SA/WP  armored  assault  forces. 

Production  weapons  for  defeat  of  armored  assault  elements  are  of  two  types.  The 
non-autonomous  weapons  are  typically  command-link  or  semi-active  guided  weapons,  such 
as  the  Laser  Guided  Bomb  (LGB).  The  LGB  weapon  group  is  comprised  of  converted  "iron 
bombs"  that  weigh  250-1000  Kg.  The  autonomous  guided  weapons,  such  as  the  U.S. 
MAVERICK,  have  warheads  of  reduced  weight  to  reflect  the  guidance  accuracy  of  these 
weapons.  These  weapons  have  extended  range  relative  to  the  LGB  group.  However,  even 
these  lethal  weapons  weigh  on  the  order  of  250  Kg.  Using  the  F  - 16 /MAVERICK  as  the 
nominal  example,  a  single  sortie  carries  4-6  missiles  and  can  reasonably  anticipate  the 
destruction  of  2-3  targets.  This  represents  a  dramatic  improvement  in  sortie 
efficiency  compared  to  the  WWII  and  Korea  experience.  However,  considering  the  target 
array  in  a  SA/WP  armored  assault  thrust,  production  weapons  require  a  number  of 
aircraft  sorties  to  accomplish  the  CAS/BI  missions  that  exceed  practical  limits 
if  1  NATO  aircraft  were  assigned  to  these  missions.  This  problem  is  a  direct  result 
of  the  multitude  of  targets  to  be  destroyed  and  of  the  restricted  number  of  production 
weapons  that  an  attack  aircraft  can  carry  into  combat. 

The  operational  characteristics  of  production  weapons  pose  another  problem.  The 
guided  weapons,  such  as  the  LGB,  typically  limit  the  aircraft  to  attack  one 
target  per  pass  over  the  target  area.  This  is  a  result  of  the  limited  velocity/range 
of  the  weapons  and  of  the  fact  that  each  weapon  is  guided  by  continuous  designation  of 
the  target.  The  autonomous  guided  weapons  have  greater  range/velocity  than  the  guided 
bombs.  However,  the  timelines  required  to  sequentially  acquire/ track  targets  by  the 
aircraft  FC8  and  for  each  missile  seeker  to  lock-up  on  its  assigned  target  permit  a 
maximum  of  2-3  targets  to  be  attacked  in  a  given  pass  over  the  target  area.  Even  this 
number  of  attacks  per  pass  can  be  reduced  by  501  or  more  if  there  exists  a  requirement 
to  discriminate  high  priority  targets.  The  limited  carriage  (load-out)  constraints 
combined  with  the  weapon  cost  factor  and  the  typical  pressure  of  the  tactical  situation 
will  usually  impose  this  discrimination  requirement.  The  operational  characteristics 
of  the  semi-active  and  autonomous  guided  weapons  prohibit  an  attack  aircraft  from 
achieving  a  high  target  service  rate.  In  point  of  fact,  it  should  not  be  considered 
too  extreme  to  say  that  target  service  rate  is  on  the  order  of  the  aircraft  sortie 
generation  rate.  Considering  the  limited  nuaber  of  aircraft  allocated  to  the  CA8/B1 
missions  and  the  limitations  on  aircraft  sortie  generat ion/ turn-around ,  the  ability  of 
MATO  aircraft  to  achieve  a  desirable  high  target  service  rate  is  a  serious  question. 

The  cost  of  production  guided  weapons  is  a  major  factor  in  several  reapects. 
Unfortunately,  the  cost  factor  is  often  misinterpreted.  The  cost  of  production  weapons 
varies,  based  on  complexity/capabi 1 ity ,  from  a  nominal  $25»000  to  $100,000  or  more.  A 
superficial  examination  would  indicate  a  very  favorable  cost-to-kill  for  these  weapons 
against  high  value  targeta  such  as  tanks.  However,  the  higher  cost  and  more  capable 
weapons  have  a  degraded  cost  effectiveness  against  targets  other  than  tanks  and  Air 
Defense  Units  (ADUs).  The  lower  cost  weapons,  such  as  the  LGB,  would  appear  cost 
effective  against  targets  that  are  not  high  value.  These  absolute  cost  aspects  are 
procurement  cost  —  the  cost  to  buy  the  weapons  for  training  and  to  put  on  the  shelf 
for  war.  Procurement  cost  plays  an  important  role  in  peacetime  defense  budgets  in  that 
it  determines  the  number  of  weapons  which  are  to  be  available  for  training  and  for 
war . 


A  more  subtle  and  more  important  cost  aspect  is  often  overlooked  or  under 
emphasised.  This  aspect  is  the  cost  to  use  the  weapons  in  war,  which  ia  why  they  were 
developed  and  procured  in  the  first  instance.  Thia  cost  aspect  includes  the  definitive 
cost  of  aircraft  and  their  av ionics /FC8s  lost  during  operations  to  employ  these  weapons 
i.i  combat.  There  are  also  costs  such  as  fuel  and  operat ions /maintenance  which  are  a 
minimal  contribution  to  this  aspect.  An  additional  and  important  element  of  this 
aspect  is  the  cost  of  adequate  training  to  establish  and  maintain  aircrew  confidence 
and  competence  in  the  use  of  the  weapon.  While  the  value  of  training  is  qualitative 
and  intangible,  it  is  inherently  obvious  that  it  is  essential  and  plays  a  critical  role 


Ln  the  ultimate  utility/ef fectivenes*  of  the  weapons  during  war. 

The  cose  of  lost  aircraft  and  their  avionics/FCSs  ia  by  far  the  dominating  factor 
in  the  cost-to-kill  equation,  even  to  the  extent  of  negating  the  impact  of  the 
procurement  coat  of  the  weapons  carried  on  a  given  sortie.  The  specific  quantitative 
cost  of  killing  targets  is  a  function  of  scenario;  the  number  of  sorties  flown  against 
the  target  array;  the  number  and  nature  of  the  SA/WP  ADUs  during  ingress  to,  egress 
from,  and  the  operational  tactics  used  over  the  target  area.  The  qualitative  nature  of 
this  dominating  cost  of  aircraft  lost  in  combat  ia  directly  coupled  with  the  number  of 
passes  per  sortie  and  the  number  of  sorties  required  to  accomplish  the  CAS/BI 
missions . 

This  dominating  factor  has  the  effect  of  increasing  the  cost-to-kil l  by  a  factor  of 
i-40.  The  lower  procurement  cost  weapons  require  multiple  passes  per  sortie  and  very 
large  numbers  of  sorties  to  kill  the  quantity  of  targets  required  to  successfully 
conduct  the  CAS/BI  missions.  That  is  the  reason  that  production  non-autonomoua  weapons 
experience  the  upper  range  of  the  cost-to-kill  increase  factor.  Concentration  on  the 
peacetime  budget  process  has  lead  NATO  to  stockpile  quantities  of  low  procurement  cost 
weapons  that  will  be  very  expensive  to  use  during  war. 

The  production  weapons  of  greater  operational  capabilities  and  greater  procurement 
cost  experience  the  lower  range  of  the  cost-to-kill  increase  factor.  This  would  then 
appear  to  make  the  weapons  that  are  more  expensive  to  procure  the  lower  cost  weapons 
for  tactical  air  warfare.  While  this  is  true,  on  a  relative  scale,  these  weapons  also 
have  an  absolute  high  cost-to-kill  value. 

In  addition,  the  high  procurement  cost  creates  two  major  peacetime  problems  that 
will  become  manifest  during  war.  The  first  problem  is  two-fold  in  that  the  high 
procurement  cost  makes  it  difficult  to  stockpile  adequate  numbers  of  weapons  for  either 
competency  training  or  for  war.  This  is  reflected  by  the  strong  concern  over  this 
problem  which  is  expressed  by  all  NATO  forces.  The  second  problem  is  related  to  the 
limited  stockpile  availability  and  aircraft  load-out  of  these  weapons  which  makes  it 
imperative  that  they  be  fired  against  high  priority  targets  in  the  CAS/BI  missions; 
i.e.,  tanks.  This  places  an  immediate  burden  on  aircrew  members.  It  also  places  a 
major  burden  on  the  attack  aircraft  avionica/FCS.  Both  aircrew  and  FCSs  are  driven  to 
discriminate  high  priority  targets  under  combat  conditions.  The  net  effects  are  to 
reduce  the  attacks  per  pass  while  increasing  aircraft/aircrew  exposure  to  ADUs  due  to 
the  associated  increases  in  required  passes  and  to  increase  the  technical  complexity 
and  the  associated  de ve lopment / pr oduc t ion  costs  of  the  FCS. 

2.3  Status: 

The  current  weapons  and  the  aircraft  systems  to  deliver  the  weapons  are  the  result 
of  technological  evolutioa.  The  technical  capabilities  represent  awareness  that 
targets  must  be  hit  to  be  efficiently  destroyed.  This  awareness  is  reflected  in  the 
guidance  accuracy  of  modern  weapon  systems.  However,  the  current  systems  are  either 
low  cost  to  stockpile  but  unacceptably  expensive  to  use  in  war  or  low  cost  for  war  but 
too  expensive  to  stockpile.  In  no  event  do  any  of  the  production  weapons  permit  attack 
aircraft  to  achieve  dramatic  kills  per  pass  and  kills  per  sortie.  This  most  important 
facet  is  driven  to  some  degree  by  cost  but  primarily  by  the  limited  number  of  weapons 
that  can  be  carried  in  a  sortie.  Product  improvement  programs  of  production  weapons 
are  oriented  to  provide  improved  performance,  but  they  do  not  and  can  not  address  the 
inherent  problems  described  above. 


A  SOLUTION  TO  THE  TACTICAL  AIR  WARFARE  CAS/BI  PROBLEM 


Solutions  to  the  CAS/BI  mission  problems  must  be  affordable,  in  peace  and  in  war. 
The  solutions  must  minimise  the  impact  on  the  aircraft  FC8  and  aircrew  in  terms  of 
target  discrimination.  The  solutions  must  permit  NATO  forces  to  perform  sufficient 
training  to  gain  both  competency  and  confidence  in  the  weapon  system  --  the  latter  only 
follows  the  former.  The  solutions  must  maintain  the  guidance  accuracy  for  the  weapon 
to  hit/destroy  its  assigned  target.  The  solutione  must  exhibit  physical  and 
operational  characteristics  that  allow  the  attack  aircraft  to  carry  a  large  quantity  of 
weapons  that  will  provide  the  aircraft  with  high  kills  per  pass  and  kills  per  sortie. 
True  solutions  will  not  have  any  single  characteristic  but  will  Integrate  all  of  these 
critical  attributes  into  an  effective  weapon  system.  Current  and  near-term  technology 
will  not  support  the  embodiment  of  all  these  critical  attributes  in  the  missile  alone. 
However,  current  technology  will  support  a  well  conceived  approach  to  closely  couple 
aircraft  avionics/  FC8s  and  the  missile  to  achieve  these  important  goals.  The  0.8.  Air 
Force  is  in  the  process  of  demonstrating  such  a  concept  —  the  Hypervelocity  Missile 
(HVM) . 


3.1  Concept  of  Operations: 

The  HVM  concept  of  operation  is  based  on  tha  following  tenets  (see  Figure  2): 


(a)  The  strike  aircraft  (such  as  tha  F-16  or  A-10)  will  approach  tha  target 
area  at  an  altitude  between  60  and  300  maters.  Tha  aircraft  FC8  has  the  capability  to 
acquire  and  continuously  track  multiple  targets  simultaneously.  This  portion  of  the 
PCS  is  functionally  designated  as  a  Target  Acquisition/Tracking  System  (TATS).  The 
TATS  may  be  based  on  FLIt  (such  as  LANTIIN)  or  active  electro-optical  radar 
technology.  A  conventional  radar  TATS  would  not  provide  the  required  tracking  accuracy 
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nor  the  desired  covertness. 

(b)  The  strike  sircrsft  PCS  slso  has  so  Active  Electro-Optical  Guidance  Systea 
(AEOGS).  The  function  of  the  AEOGS  is  to  use  target  position  inforaation  obtained  froa 
the  TATS  to  aaintain  the  active  optical  guidance  raster  on  the  target.  The  aissile 
uses  a  tiae-position  scheae  to  calculate  its  position  relative  to  the  target  (which  is 
centered  in  the  raster)  and  guide  to  the  target  with  "h i t- to-ki 1 l "  accuracy.  The  AEOGS 
does  not  "designate"  the  target  by  use  of  reflected  energy  nor  does  the  PCS  track  the 
aiasile.  The  AEOGS  is  capable  of  providing  aultiple  guidance  rasters,  to 
s iaul taneous ly  guide  aultiple  (6-10)  independent ly-targeted  aissilea,  at  a  high 
sequential  rate  within  the  AEOGS  field  of  view  (S°x2S°).  The  coabination  of  the 
TATS  and  the  AEOGS  serve  the  function  of  the  conventional  aissile  seeker. 

(c)  The  aircraft  PCS  also  perforas  two  tasks  that  are  iaportant  to  aissile 
accuracy.  Pirst,  the  aissile  tiae-position  guidance  scheae  requires  an  accurate 
synchronization  of  the  aissile  clock  and  the  PCS/AEOGS  clock.  This  sychronizat i on  is 
accoaplished  by  the  PCS  iaaediately  prior  to  aissile  launch.  Second,  the  PCS 
initializes  the  aissile  with  a  nuaber  of  launch  aircraft  and  target  variables.  This 
inforaation  is  used  to  initialize  the  aissile  guidance  filters  and  to  coapute  aissile 
guidance  for  that  short  period  after  launch  prior  to  receiving  the  guidance  raster. 

(d)  The  aissile  is  saall,  lightweight,  low  cost,  and  has  high  velocity  to 
target  iapacts  7.5-10  ca  diaaeter,  8-23  Kg,  $5000,  and  1  550  a/s.  These 
characteristics  enable  a  strike  aircraft  to  achieve  a  high  load-out  (for  exaaple,  40 
aissiles  on  the  P-16)  of  affordable,  effective  weapons.  The  high  velocity,  coupled 
with  the  of f-bores ight  capabilty  and  the  aulti-aissile  guidance  of  the  AEOGS,  peraits  a 
large  nuaber  of  targets  to  be  serviced  at  a  very  rapid  rate.  These  characteristics 
also  serve  to  ainiaise  exposure  of  strike  aircraft  to  the  air  defences  that  accoapany 
SA/WP  araored  assault  forces.  The  high  load-out,  low  cost,  and  high  velocity  perait 
the  strike  aircraft  to  attack  all  eleaents  of  the  assault  force.  This  negates  any 
requireaent  for  the  TATS  to  perfora  target  classification  (tanks  versus  trucks,  etc). 
In  effect,  a  single  aircraft  can  essentially  perfora  a  barrage  attack  with  highly 
accurate,  lethal  weapons.  If  classification  were  available  froa  the  TATS,  there  would 
be  lose  enhanceaent  of  aission  effectiveness  since  the  ADUs  could  be  reaoved  quickly 
and  the  strike  aircraft  could  attack  the  reaaining  assault  force  eleaents  with 
iapunity.  The  coabined  effect  of  these  tenets  is  to  provide  CAS/BI  aircraft  with  an 
order  of  aagnitude  increase  in  affordable  firepower. 

(e)  The  HVM  capability  has  potential  for  app  lication  to  the  role  of  ground 
forces  in  this  aission  area.  NATO  AAHs  aust  not  only  destroy  SA/WP  araored  assault 
forces,  but  they  are  increasingly  concerned  with  defeating  Soviet  attack  helicopters. 
The  ground  forces  aay  also  use  ground  vehicles  for  this  dual  role.  The  U.S.  Aray  has 
expressed  interest  in  the  HVM  as  a  aeans  of  aeeting  these  requireaents  froa  both  launch 
platf oras . 

3.2  The  PCS/AEOGS  Guidance  Function: 

The  aissile  has  no  seeker,  in  the  conventional  sense,  yet  the  aissile  is  capable  of 
"h it- to-ki 11"  accuracy.  The  PCS/AEOGS  plays  a  critical  role  in  achieving  this 
accuracy.  The  AEOGS  uses  target  position  inforaation  provided  by  the  TATS  to  center 
the  guidance  raster  on  the  target.  The  aissile  guidance  scheae  drives  the  aissile  to 
the  tiae  center,  which  is  also  the  geoaetric  center,  of  this  guidance  raster  at  target 
iapact.  Therefore,  the  accuracy  of  the  positioning  of  the  raster  on  the  target  drives 
the  accuracy  of  the  aissile. 

The  AEOGS  generates  the  raster  by  "painting"  raster  lines  in  a  sequential  aanner. 
The  AEOGS  requires  a  fixed  elapsed  tiae  to  generate  this  l°xl°  raster.  After 
coapletion  of  a  raster,  the  AEOGS  goes  "silent"  for  a  tiae  equivalent  to  the  raster 
generation  tiae.  The  AEOGS  uses  both  electronic  and  aechanical  devices  to  reposition 
the  raster  during  the  "silent"  period.  Multiple  aissile  siaultaneous  guidance  is 
accoaplished  by  positioning  this  raster  on  each  target  sequentially.  This  process  puts 
the  entire  aissile  guidance  problea  in  the  tiae  doaain  rather  than  the  spatial  doaain. 
As  the  TATS  establishes  track  files  on  each  target  in  the  array  to  be  attacked,  the  PCS 
logic  establishes  a  reference  tiae  slot.  The  AEOGS  is  directed  to  position  a  raster  on 
each  target,  with  each  raster  scan  to  be  initiated  at  a  deterained  point  in  tiae 
relative  to  the  reference  tiae.  After  all  targets  in  the  attack  array  have  been 
serviced  by  a  raster,  the  AE0G8  repeats  the  sequential  process  until  a  total  elapsed 
tiae  (1-3  seconds)  equivalent  to  iapact  on  the  aaxiaua  range  target  has  been  reached. 
The  PCS  logic  can  then  repeat  the  entire  process  for  a  new  attack  array.  The  PCS  doea 
not  explicitly  assign  a  aissile  to  a  target;  instead  the  PC8  assigns  each  aissile  a 
tiae  corresponding  to  the  start  of  a  raster  scan.  It  is  necessary  for  the  aissile  to 
have  a  clock  sod  the  aissile  clock  aust  be  synchronized  with  the  AEOGS  clock.  This 
synchronisation  sod  the  aissile  tiae  slot  assignaent  is  done  as  part  of  the  PCS 
initialization  of  the  aissile. 

The  AEOGS  generates  two  separate  rasters,  each  froa  a  separate  active  aource. 
Neither  raster  is  spatially  aodulated  (coded).  The  function  of  the  Course  Guidance 
taster  (CCS)  is  to  provide  data  to  the  HVM  during  aissile  flight  froa  a  point 
iaaediately  after  launch  to  a  tiae  position  in  the  CGI  such  that  the  HVM  can  receive 
data  froa  the  Pine  Guidance  taater  (PCI).  The  CGI  has  a  fixed  f ield-of-regard  (P0I)  of 
6<>x25o.  The  CGI  is  not  agile  but  is  slaved  to  the  TATS  P0I. 


Th«  function  of  the  CGR  i»  simply  to  insure  th«  HVM  is  rapidly  positioned  such  that 
the  missile  can  receive  the  PGR .  The  CGR  is  generated  by  a  aeparate  source  in  the 
AEOCS.  The  CGR  has  a  fixed  FOR  that  is  only  effective  over  a  limited  range  (approxi- 
■  ately  3500  feet  froa  aircraft).  As  part  of  the  aissile  initialisation  and  clock 
synchronisation,  the  missile  is  provided  a  definition  of  its  assigned  tiae  slot  in  the 
CGR  which  corresponds  to  the  spatial  position  on  which  the  PGR  will  be  centered.  The 
missile  uses  the  t iae-o f - a r r i va 1  technique  to  determine  its  position  in  the  CGR 
relative  to  its  assigned  time  slot  and  hence  to  determine  the  aissile  control  commands 
required  to  maneuver  itself  toward  the  proper  tiae  slot  in  the  CGR.  Once  positioned  in 
the  assigned  time  slot  in  the  CGR,  it  maintains  this  relative  time  position  until  it 
receives  energy  from  the  PGR.  In  essence,  the  aissile  treats  the  assigned  CGR  tiae 
slot  as  a  "target*1  until  it  receives  the  PGR.  The  missile  has  a  "time  gate"  in  which 
it  is  to  expect  its  assigned  PCR  to  appear.  Once  under  control  of  the  PGR,  the  missile 
"tiae  gates"  out  any  future  CCR  input.  These  "tiae  gates"  provide  the  aissile  the 
basic  mechanism  to  discriminate  CCR  energy  froa  PGR  energy.  A  similar  mechanism  is 
used  by  the  aissile  to  discriminate  its  assigned  PGR  energy  froa  energy  due  to  the  PGR 
of  other  missiles  in  flight  simultaneously. 

The  function  of  the  PGR  is  to  provide  t  iae-pos  i  t  ion  data  to  the  HVM  to  insure 
target  intercept.  The  PGR  has  a  FOR  of  l°xl°  that  is  centered  on  the  target.  The 
PGR  is  generated  by  the  AEOCS  which  provides  PGR  agility  by  the  use  of  mechanical 
scanners  which  esn  position  this  PGR  within  a  total  FOR  of  5°x25°.  The  details  of 
how  missile  guidance  and  control  ir  derived  froa  the  PCR  ere  included  in  paragraph 
3.4. 

The  PCS  system  provides  a  number  of  aircraft  and  target  variables  to  the  aissile  as 
part  of  the  initialisation  procedure.  These  variables  include  wind  and  velocity 
components,  aircraft  atata  data,  targat  atate  data,  and  aircraf t/targat  relative 
geometry  and  range.  These  variables  are  used  by  the  missile  to  initialise  the  guidance 
filters  and  for  initial  guidance  calculations  prior  to  the  missile  receiving  the 
guidance  raster  shortly  aft#r  launch.  A  more  detailed  discussion  of  missile  initiali¬ 
sation  ia  included  in  paragraph  3.4. 

3.3  The  Simple  Missile: 

The  HVM  has  generic  subsystems  similar  to  traditional  missiles  except  it  does  not 
have  s  seeker,  per  se,  nor  does  it  have  s  fuse  or  explosive  warhead.  In  another  sense, 
it  is  lacking  those  subsystems  that  nominally  account  for  75-85X  of  the  cost  and 
reliability  problama  of  traditional  miaailas.  Further,  the  abaenae  of  these  subsystems 
and  the  associated  weight,  volume,  and  form  factor  allow  the  HVM  to  be  small  and  light¬ 
weight.  Thaaa  aapacts  provide  the  critical  contribution  that  the  HVM  offers  to 
tactical  strike  aircraft  --  high  load-out  of  affordable,  effective  weapons. 

The  HVM  is  ae  rody  nami  ca  1 1  y  stabilised  by  a  split-petal  flare  at  the  base  of  the 
missile.  The  missile  is  controlled  by  the  Attitude  Control  System  (ACS)  which  is 
mounted  in  the  forward  portion  of  the  missile.  The  ACS  has  two  plenum  chambers,  each 
with  s  nossle.  Each  chamber  is  pressurised  by  the  discrete  firing  of  s  high  impulse, 
short  duration  squib.  The  missile  spins  at  s  nominal  rate  to  cossuttte  the  ACS.  A 
roll  reference  sensor  provides  reference  roll  position  and  permits  the  missile  to 
calculate  roll  rate  and,  thus,  whan  a  squib  should  be  fired  to  achieve  the  desired 
course  correction.  The  primary  mechanism  for  achieving  s  major  missile  attitude  change 
is  the  contribution  from  motor  thrust  rather  than  ACS  thrust.  The  motor  has  s 
boos t / sue ta in  thrust  ratio  of  approximately  10:1.  Therefore,  miaaile  attitude  change 
response  during  boost  is  approximately  ten  timet  the  response  during  sustain  or  coast. 


Initial  isation  —  It  is  daairabla  to  initialise  the  HVM  prior  to  launch  (sea  Fig¬ 
ure  3)  with  aircraft  deta  (velocity,  altitude,  roll  attitude,  aod  angla-o f-at tack ) , 
environmental  data  (windspeed  vector,  air  temperature,  and  density),  targat  data 
(range,  ssimuth,  and  elevation  relative  to  the  launch  aircraft),  and  ABOCS  data  (clock 
calibration  —  to  establiah  the  time  reference,  CCR  time  slot  relative  to  the  reference 
time  for  the  assigned  target,  and  time  for  start  of  the  assigned  PGR  scan  relative  to 
the  reference  time).  The  HVM  uaea  this  data  to  compute  time-to-go,  launch  jump,  filter 
states,  and  predicted  aircraft/ target  geometry  at  intercept.  This  data  is  also  used  to 
initiate  the  missile  clock  synehroniset ion ,  batteries,  the  receiver  cryogenic  cooler, 
roll  reference  sensor,  and  rocket  motor.  If  initialisation  data  is  not  provided,  the 
missile  will  have  pre-loaded  nominal  values  for  initialisation.  Accuracy  is  degraded 
as  a  function  of  which  data  arc  not  provided  and  of  how  far  the  pre-loaded  nominal 
valuta  are  from  actual  values.  In  the  worst  case  (no  init ial isat ion  data),  accuracy 
can  ba  recovered  by  restricting  the  launch  aircraft  to  a  dedicated  attack  on  the  targat 
(tha  aircraft  stays  pointed  at  the  targat  until  intercept)  as  opposed  to  the 
simultaneous  attack  of  multiple  target*.  Detailed  aanaitivity  and  trade  studies 
related  to  ini t is  1 i set  ion  snd  preloaded  nominal*  will  be  the  subject  of  future 
efforts. 

3.4  HVM  Guidance  A  Control  Concept: 

The  beamrider  concept,  with  various  implemantst ions ,  has  bean  the  historical  method 
of  tactical  missile  guidance  using  electro-optical  (BO)  guidance  links.  Tha  concept 
has  bean  oriented  to  launch  from  stationary  pointa  on  tha  ground  or  from  relatively 
alow  airborne  platforms  (helicopters).  Ths  basic  concept,  ragardlaaa  of 
implementation,  ia  for  the  missile  to  maintain  itself  in  tha  canter  of  tha  SO  beam, 


2-6 


1 

which  is  centered  on  the  t«r|«t,  throughout  the  missile  trajectory.  The  AEOGS  CGR  and 
PGR  are  analogous  to  this  EO  beam.  In  these  traditional  appl icat ions ,  the  line-of- 
sight  (LOS)  between  the  guidance  source  and  the  target  is  either  constant  or  changes  at 
a  very  slow  rate.  For  attack  aircraft  applications,  the  aircraf t/target  LOS  is 
changing  at  a  relatively  high  rate.  This  factor  is  a  driving  influence  on  the  HVM 
guidance  concept  which  is  a  significant  variation  from  the  beam-rider  approach. 

Based  on  initialisation  data/calculations,  the  missile  computes  the  expected 
aircraft  and  target  position  at  target  intercept  (position  3  on  Figure  6)  and 
establishes  an  orthogonal  spatial  reference  system  based  on  the  predicted  LOS  in  that 
intercept  geometry  (the  x  and  x  coordinates  are  shown  on  Figure  4).  Synchronisation  of 
the  AEOGS/missile  clocks  at  launch  allows  the  missile  to  establish  a  reference  time  for 
the  start  of  each  FCt  scan  and  the  FGt  scan  time  is  a  fixed  value.  The  time-of- 
arrival,  relative  to  the  reference  time,  of  active  optical  eoergy  on  the  missile 
receiver  allows  the  missile  to  calculate  its  position  relative  to  the  center  of  the 
raster  (sae  figure  3).  Additional  on-board  calculations  permit  estimates  of  the  real¬ 
time  velocity  and  displacement  components  relative  to  the  reference  coordinate  system. 
Figure  6  indicates  the  gaome t ry / ca 1 cu  l  at  ions  for  the  c-axis  and  elevation  (the  y-axis, 
asimuth  geometry/calculations  are  similar).  The  missile  now  has  the  information 
necessary  to  implement  Che  guidance  concept. 

The  guidance  concept  is  designed  to  avoid  missile  reaction  to  the  high  aircraft/ 
target  LOS  rate  during  missile  flight  to  target  intercept  and  to  make  optimum  use  of 
the  ACS  control  authority.  The  goal  of  the  guidance  logic  is  to  shape  the  missile 
trajectory  such  that  major  missile  heading  changes  occur  early  in  flight  (during  boost) 
and  such  that  the  missile  trajectory  asymptotically  aproaches  the  predicted  L08  at 
target  intercept.  Therefore,  two  sequential  guidance  laws  are  used  during  flight  with 
transition  based  on  the  defined  time  for  boost-to-sustain  motor  transition. 

Boost  phase  guidance  ia  an  acceleration  command  pursuit  guidance  mode  with  the 
objective  being  to  orient  the  missile  velocity  vector  to  the  predicted  LOS  to  the 
tsrget  at  intercept.  This  permits  the  ACS  to  provide  maximum  missile  turning  during 
that  period  of  time  that  the  ACS  is  most  effective  for  that  purpose  (see  Figure  7). 

The  sustain  phase  guidance  is  an  acceleration  command  proportional  guidance  mode. 
This  phase  will  complete  any  remaining  heading  change  required  and  then  maintain  the 
missile  on  the  required  intercept  line.  This  is  accomplished  as  the  guidance  law 
drives  the  displacement  and  velocity  components,  relative  to  the  reference  coordinate 
system,  to  lero  prior  to  intercept.  The  reduced  ACS  control  authority  during  sustain 
and  coast  reduces  the  possibility  of  missils  over-correction  as  the  missile  approaches 
target  intercept.  The  guidance  laws  used  ia  both  phases  are  incorporated  in  the 
typical  logic  implementation  shown  in  Figure  8. 

The  key  poiots  are:  The  missile  trajectory  is  shaped  to  approach  the  predicted 
aircraf t/target  LOS  at  intercept;  the  CCR/FGR  are  used  during  the  boost  phase  of  flight 
to  shape  the  missile  trajectory;  the  FCI  is  used  in  the  latter  portion  of  flight  to 
insure  target  intercept  by  nulling  the  cross-course  velocity  and  displacement 
components.  It  should  be  noted  that  as  time  to  intercept  approaches  aero,  the  actual 
aircraf t/target  LOS  approaches  the  predicted  LOS.  As  this  occurs  the  8VM  guidance 
concept  approaches,  in  a  gross  sense, the  conventional  beamrider  as  the  missile  is 
driven  to  the  center  of  the  FGt  which  is  centered  on  the  a i rcra f t / target  LOS.  lowever, 
there  is  a  most  significant  difference.  A  typical  beamrider  missile  requires  the  BO 
beam  to  be  maintained  continuously  on  the  target  until  intercept.  The  BVtt  guidance 
concept  uses  the  guidance  raster  to  update  the  guidance  filters.  The  missile 
actually  flies  on  these  filters  and  the  absence  of  updates  has  a  graceful  degradation 
effect  on  the  accuracy  of  these  filters  rather  than  a  catastrophic  effect.  Ths 
robustness  of  this  approach  has  been  demonstrated  in  ground- 1 auached  flight  teats  whers 
the  missile  has  maintained  guidance  accuracy  while  not  receiving  a  portion  of  the 
updates  provided  during  flight. 
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SUMMARY 

The  Norwegian  Penguin  Me 3  anti-ship  missile  is  currently  being  integrated  for  opera¬ 
tion  on  the  F-16  aircraft*  Due  to  the  inherent  flexibility  of  both  the  aircraft  and  the 
missile  syetem,  no  hardware  Changes  are  required  on  the  aircraft.  Software  changes  are 
designed  euch  that  the  pilot  can  operate  the  weapon  to  its  full  performance  by  using 
existing  cockpit  controls  and  displays  in  a  way  quite  similar  to  other  air-to-ground 
missions.  ^ 


1  INTRODUCTION 


The  Royal  Norwegian  Air  Force  has  established  the  requirement  for  the  Penguin  Mk2 
anti-ship  missile  for  carriage  on  the  F-16  aircraft.  Kongsberg  Vipenfabrikk  is  contracted 
for  the  missile  development.  The  Norwegian  Defence  Research  Establishment  has  been 
responsible  for  the  development  of  the  target  seeker  and  the  inertial  navigation  system. 
General  Dynamics  is  contracted  (via  U8AF )  for  the  aircraft/missile  integration  and  cer¬ 
tification.  Prototype  test  firings  from  a  Norwegian  F-16  are  scheduled  during  1984. 

This  paper  outlines  the  main  features  of  the  Penguin  weapon  system  as  integrated  into 
the  avionics  and  fire  control  system  of  the  F-16  aircraft.  Figure  1  shows  an  F-16 
aircraft  equipped  with  Penguin  during  captive  tests. 


2  THE  PENGUIN  Mfc3  AIR  LAUNCHED  MISSILE 


This  Chapter  describes  the  main  characteristics  of  the  Penguin  Mk3  air  launched 
missile.  This  is  necessary  as  a  background  for  understanding  the  integration  require¬ 
ments  and  mechanization. 


2.1  Outline  Description 

Penguin  Mk 3  is  a  major  redesign  of  the  ship-to-ship  Mk2  version,  now  operational  with 
the  Norwegian  navy  among  others.  Obvious  differences  between  the  Mk3  and  the  Mk2  are 
that  the  Mk3  is  longer,  has  wings  of  reduced  span  and  has  a  greater  range.  The  general 
layout  though,  is  similar. 

Figure  2  illustrates  the  exterior  and  interior  of  the  missile.  The  target  seeker  is 
based  on  infrared  detection.  The  canard  fins  are  actuated  by  a  cold  gas  powered 
hydraulic  motor.  The  altimeter  is  a  radar  altimeter.  The  control  unit  is  all  digital 
and  contains  the  autopilot,  trajectory  generation,  missile  Internal  information  bus 
control  and  other  functions.  The  inertial  navigation  platform  is  a  semi  strap-down  plat¬ 
form  (roll  axis  is  gl mbs led)  using  two-axes  dry  tuned  gyros.  The  platform  provides 
3-diiaensional  navigation  and  angular  information.  The  warhead  is  a  modified  Bullpup  type 
with  a  delayed-action  impact  fuze.  Penguin  Mk3  will  have  a  new  single-chamber  sustainer 
rocket  motor  using  a  composite  grain.  The  airframe  is  roll  stabilized  by  electrically 
powered  ailerons. 


2.2  Main  Specifications 


These  are  the  Penguin  MX 3  main  specifications! 


Length 
Wingspan 
Body  diameter 
Weight 

Weight  incl  launcher 
Warhead  weight 
Range 
Speed 

Turn  angle  after  waypoint 
Launch  altitude 
Launch  speed 

Off-boreslgn  angle  at  launch 
Captive  flight  altitude  up  to 
Captive  flight  speed  up  to 
Aircraft  maneuver  limit 


3.20  a 
1.00  a 
0.28  a 
350  kg 
400  kg 
120  kg 

5-40  +  km  at  sea  level 


high  subsonic 
0-90°+ 

150-30  000  ft 
Mach  0.7-0.95 
0-50°+ 

40  000  ft 


Mach  1.2 
8  g 


3-2 


2 . 3  Modes  of  Operation 

The  basic  requirement  for  the  Penguin  Mk3  weapon  system  is  to  provide  the  Norwegian 
F-16s  with  stand-off  “f ire-and-forget"  anti-ship  capability.  The  pilot  must  be  able  to 
effectively  attack  targets  in  open  waters ,  coastal  waters  and  in  fjord  areas  while  flying 
over  land  or  sea.  All  existing  F-16  targeting  and  fire  control  avionics  must  be  at  the 
pilot's  discretion  for  effective  missile  delivery.  Fulfilling  these  requirements  and 
still  maintaining  simple  system  operation  has  been  one  of  the  greatest  challenges  during 
the  weapon  operation  mechanization  effort.  A  number  of  experienced  fighter  pilots  have 
made  the  most  important  contributions  to  the  current  mechanization  solution. 

The  pilot  operation  of  the  Penguin  weapon  system  is  best  understood  by  describing  the 
main  weapon  delivery  modes  which  are  (in  parenthesis  are  the  display  mnemonics  as  viewed 
on  the  Stores  Control  Display): 

-  RADAR  MODE  ( RDR) .  This  mode  is  optimized  for  targeting  by  means  of  the  fire  control 
radar.  The  mode  also  include  the  capability  of  delivery  against  preprogrammed  target 
coordinates. 

-  HEAD  UP  DISPLAY  MODE  (HUD) .  This  mode  is  optimized  for  targeting  by  means  of  the  Head 
Up  Display  optical  sight.  The  mode  has  two  options ,  namely  HUD  TURN  (HLT  or  HRT,  left 
or  right  turn  respectively)  and  HUD  DIRECT  (HUDD).  The  HLT  or  HRT  option  include  the 
possibility  of  establishing  a  turnpoint  or  waypoint  by  pointing  with  the  aircraft.  The 
missile  will  turn  to  the  left  or  to  the  right  respectively  at  this  waypoint.  In  addi¬ 
tion  this  option  gives  the  pilot  the  possibility  of  preprogramming  a  descent  point 
where  the  missile  levels  out  to  low  level  flight.  The  HUDD  option  provides  no  such 
possibilities,  it  is  essentially  an  "aim-and-shoot"  option.  However,  a  triangulation 
target  ranging  procedure  will  be  at  the  pilot's  discretion  When  using  the  HUDD  option. 

-  MANUAL  MODE  (MAN).  This  mode  is  a  back  up  mode  in  case  some  failure  occurs  in  the 
aircraft's  fire  control,  inertial  navigation  or  avionics  bus  communication  system.  In 
this  mode  the  pilot  can  fire  the  missile  at  degraded  performance  While  aiming  with  the 
aircraft  bore-sight  axis  and  keeping  the  aircraft  straight  and  level. 

Figure  3  presents  an  example  of  attack  sequence  using  the  RDR  mode.  The  pilot  lets 
the  radar  paint  the  expected  target  area.  Then  he  freezes  the  radar  picture  on  the  radar 
display,  breaks  away  and  seeks  terrain  protection  while  he  processes  the  display.  He 
slews  the  target  and  waypoint  cursors  to  desired  positions  and  fires  the  missile  (or 
missiles).  In  this  example  the  missile  then  separates  and  turns  to  the  direction  of  the 
waypoint  While  keeping  the  launch  altitude.  Thus  the  missile  keeps  clear  of  the  terrain 
before  descending,  turning  and  leveling  out  at  the  waypoint  coordinates.  Then  it  pro¬ 
ceeds  toward  the  target  area  where  the  seeker  selects  a  target. 

Figure  4  presents  an  example  of  attack  sequence  using  the  HUD  mode,  HLT  option.  The 
pilot  aims  at  the  target  by  placing  the  HUD  target  designator  (TD)  box  on  the  target.  He 
then  makes  a  designation  command  by  which  the  designated  line-of-sight  (DLOS)  is  stored 
by  the  Fire  Control  Computer  (FCC).  The  pilot  wants  to  attack  the  target  from  the  rear 
side  and  holds  his  fire.  He  breaks  away  and  seeks  terrain  protection  While  he  maneuvers 
his  aircraft  to  the  desired  launch  position.  Here  he  points  the  aircraft  to  establish 
the  waypoint.  Which  is  confuted  as  the  sea  level  projection  of  the  intersection  between 
the  aircraft  axis  and  the  vertical  plane  through  the  DLOS.  The  missile  is  fired  and 
follows  a  trajectory  similar  to  the  one  in  Figure  3. 

Figure  5  presents  another  example  using  the  HUD  mode,  namely  the  HUDD  option  and 
targeting  by  visual  triangulation.  The  pilot  aims  and  designates  (First  Designation)  as 
in  Figure  4.  A  descent  point  (here  called  waypoint)  is  automatically  computed  on  the 
designated  line-of-sight  (DLOS  1).  In  this  low  altitude  attack  the  HUD  target  ranging 
computation  may  be  extremely  inaccurate  and  the  corresponding  location  of  the  waypoint 
may  be  highly  undesirable.  As  in  the  example  the  waypoint  may  fall  on  land  forcing  the 
missile  to  descend  into  the  rocks.  In  order  to  get  a  better  visual  ranging  to  the 
target,  the  pilot  flies  his  aircraft  to  the  side,  makes  a  second  designation  as  shown 
thus  establishing  a  second  line-of-sight  (DLOS  2) .  The  DLOS  1  and  DLOS  2  intersection 
coordinates  are  computed  by  triangulation  algorithms  in  the  FCC  program  giving  a  quite 
accurate  target  ranging.  Then  the  waypoint  (or  descent  point)  is  confuted  correctly  close 
to  the  target.  After  separation  the  missile  keeps  the  launch  altitude  until  the  waypoint 
is  reached. 


3  F-16/ PENGUIN  INTEGRATION 

From  a  physical  fit  and  operating  envelope  standpoint  the  air- launch  Penguin  is 
designed  to  be  compatible  with  a  wide  variety  of  aircraft.  A  specially  designed  adapter 
containing  prelaunch  missile  electronics  and  ejector  release  unit  assures  compatibility 
with  existing  launch  racks.  During  missile  release  or  emergency  jettison  the  adapter  is 
always  retained  on  the  pylon.  Figure  6  is  a  photo  showing  the  carriage  installation,  and 
the  adapter  is  clearly  visible. 

The  F-16  is  currently  being  certified  for  Penguin  missile  carriage  on  weapon 
station  3  and  7.  However,  it  will  be  an  easy  task  to  extend  to  a  4  sdssile  carriage  con¬ 
figuration  (station  3,  4,  6  and  7),  if  that  is  desired. 
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3.1  Electrical  Interface 


The  missile  adapter  acts  not  only  as  a  mechanical  interface  between  the  missile  and 
the  aircraft,  it  also  contains  all  the  necessary  electronics  for  interfacing  to  the 
avionics  and  store  control  system  of  the  aircraft.  The  main  electronic  functions  con¬ 
tained  in  the  adapter  are: 

-  Missile  DC  power  supplies  fed  from  the  aircraft  3  phase  110  VAC 
line 

-  Aircraft  avionics  digital  bus  remote  terminal  interface  electronics 

-  Discrete  signal  termination  and  processing  electronics 

-  Missile  data  bus  terminal  interface 

-  Digital  processor  for  processing  of  targeting,  waypoint,  launch 
sequencing,  missile  status/test  and  other  data 

-  Digital  processor  for  implementation  of  the  missile  inertial  plat¬ 
form  transfer  alignment  filter 

Figure  7  depicts  the  electrical  interconnection  between  the  aircraft  and  the  missile. 
No  special  wiring  is  required  in  the  F-16  for  the  Penguin  missile  integration.  Discrete 
signals  (power,  arming,  release  etc)  are  connected  to  the  standard  Remote  Interface  Unit 
( RIU)  in  the  pylon  and  the  missile  will  receive  mode,  target  and  alignment  information 
via  the  MIL-STD-1553  Protocol  Avionics  Multiplex  Bus. 

The  only  change  required  to  the  P-16  for  accommodating  the  Penguin  missile  is  soft¬ 
ware  change.  The  operational  flight  programs  in  both  the  Fire  Control  Conputer  (FCC)  and 
the  Central  Interface  Unit  (CIU)  of  the  Stores  Management  System  (SMS)  have  been 
increased  by  some  8%  each  to  include  the  Penguin  tasks. 

However,  these  tasks  have  been  partitioned  in  such  a  way  that  the  avionic  subsystems 
are  not  required  to  accomplish  functions  or  provide  interface  outside  their  normal 
duties.  The  SMS  provides  the  same  weapon  control,  arming  and  release  functions  that  it 
normally  provides.  The  FCC  will  compute  targeting  data  for  the  missile  %rttile  com¬ 
municating  with  the  Head  Up  Display  (HUD),  the  Radar/ Electro-Optical  Display  (R/EO)  and 
the  Fire  Control  and  Navigation  Panel  (FCNP).  The  FCC  will  also  pass  the  Inertial  Navi¬ 
gation  System  (INS)  velocity  and  angular  data  to  the  missile  for  transfer  alignment  of 
the  missile  inertial  platform. 

Figure  8  lists  the  interface  wiring  between  the  aircraft  and  missile.  All  targeting 
data  are  transmitted  via  the  double  redundant  avionics  mux  bus  twisted  wire  pairs. 
However,  the  discrete  wire  noted  MANUAL  MODE  enables  the  pilot  to  cosmand  the  missile 
system  into  a  back-up,  degraded  performance  mode  without  communicating  via  the  mux  bus. 

Figure  9  lists  the  data  messages  flowing  on  the  MIL-STD-1553  serial  digital  avionics 
mux  bus  between  the  aircraft  and  the  missile  system.  Note  that  the  missile  system 
(adapter  digital  processor)  computes  all  waypoint  coordinates  in  all  HUD  mode  options, 
based  upon  the  targeting  data  coming  from  the  aircraft  FCC.  In  the  RDR  mode,  however, 
all  waypoint  computation  is  done  by  the  FCC,  thus  the  data  noted  MISSILE  COMPUTED 
WAYPOINT  are  invalid  in  RDR  mode. 


3.2  Missile  Inertial  Navigation  System  (INS)  Alignment 

The  Penguin  weapon  operational  concept  requires  a  precise  missile  guidance  and  navi¬ 
gation  system  to  assure  good  target  selection  capability  and  a  high  hit  probability  even 
in  confined  coastal  waters.  The  heart  of  this  system  is  the  missile  inertial  navigation 
platform.  To  provide  the  required  navigation  accuracy  this  platform  must  be  aligned  with 
errors  down  in  the  milliradian  range,  velocity  initialisation  must  be  better  than  I  meter 
per  second.  Also  excessive  bias  and  scale  factor  errors  of  the  gyros  and  accelerometers 
must  be  measured  and  corrected  for.  The  only  way  to  fulfill  the  above  requirements  on  a 
fighter  aircraft  is  to  perform  a  transfer  alignment  with  the  aircraft  INS  as  the  refe¬ 
rence.  This  means  to  compare  the  data  from  the  aircraft  IN8  and  the  data  from  the 
missile  INS  and  then  filter  out  the  missile  INS  errors  based  on  differences  in  data.  The 
most  convenient  data  to  compare  in  this  respect  are  velocity  and  angular  data  and  this  is 
done  in  the  Penguin  alignment  filter.  The  alignment  filter  is  implemented  on  a  16  bits 
microprocessor  in  the  missile  adapter  as  an  18  state  Kalman  filter  using  3  velocity  and  1 
angular  measurement  (asimuth)  as  input.  Figure  10  shows  a  block  schematic  of  the  align¬ 
ment  filter  structure.  The  RELATIVE  MOTION  COMPENSATION  block  in  the  figure  coapensates 
for  missile  offset  relative  to  the  aircraft  INS  location  trtien  aircraft  rotation  occurs. 

Figure  11  shows  a  typical  filter  response  presented  as  the  standard  deviation 
(milliradlans)  of  the  angular  error  estimates  as  a  function  of  time  (seconds).  The  pitch 
(PI)  and  roll  (RO)  deviations  are  quickly  reduced  from  initial  values  of  8  mrad  to 
approximately  1  mrad.  However,  the  asimuth  (AZ)  deviation  is  significantly  reduced  only 
when  the  aircraft  performs  a  horisontal  maneuver  (3  g)  which  occurs  after  60  seconds  in 
the  example  shown. 
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3.3  Cockpit  Operations 

The  inherent  flexibility  of  the  existing  F-16  cockpit  controls  and  displays  shown  in 
Figure  12  makes  it  possible  to  add  the  Penguin  missile  without  cockpit  modifications. 

3.3.1  Stores  Control  Panel  (SCP)  Operations 

Selection  of  air-to-ground  (A-G)  on  the  SCP  will  automatically  call  up  a  Penguin 
attack  program,  which  may  be  preprogrammed  to  fit  the  mission  scenario.  If  no  prepro¬ 
gramming  has  occured,  the  standard  attack  program  shown  in  Figure  13  will  be  displayed. 
The  pilot  can  modify  the  attack  program  by  pressing  the  switches  adjacent  to  the 
displayed  mnemonics.  The  options  available  are  listed  in  Figure  13. 

The  attack  program  display  shown  advises  the  pilot  to  go  to  the  status  page  (STAT) 
because  some  failure  has  occurred.  Figure  14  shows  an  example  of  the  status  page 
display.  The  example  depicts  a  four  missile  carriage  configuration  and  a  somewhat  unfor¬ 
tunate  situation.  Station  7  is  the  cued  station  showing  a  degraded  missile.  Station  3 
has  a  hung  store.  Missile  on  station  6  is  still  aligning  (W)  while  the  missile  on  sta¬ 
tion  4  is  aligned  and  ready. 

3.3.2  Fire  Control  and  Navigation  Panel  (FCNP)  Operations 

The  FCNP  enables  the  pilot  to  key  into  the  PCC  memory  up  to  3  different  set  of 
targeting  data  consisting  of  target  coordinates,  waypoint  coordinates,  target  estimated 
course  and  speed  and  the  time -of -day  when  these  data  were  valid.  The  target  coordinates 
will  be  automatically  updated  based  on  the  estimated  course  and  speed  and  the  time-of- 
day.  The  updated  target  coordinates  are  continously  displayed  as  cursor  position  on  the 
radar  (R/EO)  display  and  on  the  Head  Up  Display  (HUD).  The  pilot  may  any  time  correct 
the  displayed  cursor  positions  by  slewing  the  cursors. 

A  spotter  function  is  included  in  the  FCC  software  for  Penguin  delivery,  the  spotter 
function  enables  the  pilot  to  store  into  the  Penguin  targeting  memory  locations  the  coor¬ 
dinates  of  the  display  cursors.  He  does  this  by  just  hitting  a  switch  button  on  the 
FCNP.  The  spotter  function  is  not  only  designed  for  Penguin  anti-ship  delivery  missions, 
but  also  for  reconnaissance  missions. 

3.3.3  Radar  (R/EO)  and  Head  Up  Display  (HUD)  Operations 

The  operation  and  symbology  on  the  R/EO  and  HUD  are  very  similar  to  normal  F-16  air- 
to-ground  display  operations.  The  normal  x-y  cursor  is  used  as  target  cursor  on  the 
R/EO,  and  an  additional  cross-hair  symbol  is  generated  for  the  waypoint.  On  the  HUD  the 
normal  air-to-ground  Target  Designator  symbol  is  used  for  the  target  and  the  offset  aim- 
point  Diamond  symbol  is  used  for  the  waypoint.  In  addition  the  FCC  confutes  continuously 
the  range  to  the  target  in  percent  of  the  missile's  maximum  range  capability  and  puts 
this  3  digit  number  up  on  both  displays.  The  pilot  may  fire  When  this  number  counts  down 
below  100. 

3.3.4  Hands-On  Operations 

Normally  all  attack  program  options  are  selected  long  before  the  aircraft  approaches 
the  weapon  launching  position.  The  remaining  operatione  required  are  hands-on  opera¬ 
tions,  that  is  the  necessary  controls  are  located  on  the  throttle  grip  and  the  side  stick 
controller.  Existing  switches  and  controls  are  utilised  to  provide  the  following 
functions: 

>  Target  and  waypoint  cursor  slew 

•  Left/Righ  missile  turn  selection  in  HUD  mode 

•  Weapon  station  selection 

-  Attack /Status  SCP  display  selection 

•  Target  designation 

•  Sighting  reinitialisation 

•  Launch  command 


4  CONCLUSIONS 
Lessons  learned 


No  hardware  changes  was  necessary  when  integrating  Penguin  Mk3  on  F-16.  This  ie 
thought  to  be  characteristic  for  advanced  weapon  systems  and  advanced  aircrafts. 

It  took  about  2  years  to  develop  the  Penguin  weapon  and  firs  control  software  for  the 
F-16  avonlce  to  a  raaaonable  mature  state.  It  is  an  iterative  process  involving  mny 
people.  Our  experienced  fighter  pilots  have  made  the  most  significant  contributions  as 
to  cockpit  operation  definitions  end  software  Check-out. 

the  Penguin  integration  required  2500  words  of  software  program  in  the  FCC  and 
3000  bytes  in  the  CZU.  this  is  probably  a  typical  software  volume  for  integrating  an 
advanced  weapon  on  a  flghtar  aircraft. 
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^  SUMMARY 

*  /The  inclusion  of  sophisticated  Navigation  function  in  a  Head-Up  Display/Weapon  Aiming 

Computer  (HUD/WAC)  is  described  together  with  integration  of  the  resultant  subsystem  into 
an  overall  Navigation/Attack  system. 

At  the  end  of  the  paper,  a  growing  trend  in  airborne  systems  computing  is  highlighted. 

1.  INTRODUCTION 

The  published  theme  of  the  symposium  states  that  advances  in  systems  concepts  allied  to 
new  technology  have  led  to  the  possibility  of  integrating  a  variety  of  systems  that  have 
traditionally  been  separate. 

The  word  "integration"  is,  of  course,  capable  of  interpretation  in  two  ways.  Firstly, 
two  or  more  subsystems  can  be  said  to  be  integrated  if  they  interface  with  each  other  and 
this  is  what  is  meant  when  integration  of,  for  example,  fire  control  and  flight  control 
is  discussed.  The  second  interpretation  of  integration  means  that  functions  which  have 
historically  been  located  in  separate  subsystems  are  located  in  one  subsystem. 

This  paper  concerns  itself  with  the  second  interpretation  of  integration  and  the  subject 
is  dealt  with  by  describing  the  equipment  that  Marconi  Avionics  (MAv)  supplied  recently 
to  form  one  subsystem  of  an  overall  Nav/AttacK  system. 

The  subsystem  itself  is  a  development  of  a  HUD/WAC  which  was,  and  still  is,  in  production 
at  the  time  of  the  start  of  the  development  program. 

Being  a  development  of  a  HUD/WAC,  the  new  subsystem  naturally  came  to  be  called  a  Head-Up 
Display/Weapon  Aiming  Computer /Navigation  System  ( HUD/WAC /NAV ) . 

As  readers  will  know,  the  concept  of  the  HUD/WAC  which  carries  out  both  Weapon  Aiming 
Computation  and  HUD  Symbol  Generation  is  not  new.  Such  systems  have  been  available  for 
some  years  now  and  have  been  reported  upon  widely.  For  this  reason,  this  paper 
concentrates  mainly  on  the  Navigation  aspects  of  the  system. 

2.  CONCEPT  OF  THE  HUD/WAC/NAV 

The  concept  of  the  HUD/WAC/NAV  arose  a  few  years  ago.  At  that  time,  MAv  were  proposing  a 
HUD/WAC  to  an  overseas  customer  who,  in  the  middle  of  pre-contract  negotiations,  asked  us 
to  propose  also  a  Navigation  Computer  to  meet  the  relatively  sophisticated  requirements 
of  a  specification  which  he  had  prepared. 

Detailed  study  of  the  customer  specification  led  us  to  believe  that  there  was  no  need  to 
provide  a  separate  Navigation  Computer,  but  that  the  requirements  could  be  siet  by 
inclusion  of  the  Navigation  functions  in  the  HUD/WAC.  This  proposal  was  accepted  and  the 
HUD/WAC/NAV  was  born. 

(For  convenience  the  HUD/WAC/NAV  will  sometimes  be  referred  to  in  the  rest  of  this  paper 
as  the  HUD). 

3.  THE  OVERALL  NAV/ATTACK  SYSTEM 

A  simplified  block  diagram  of  the  overall  Nav/Attack  system  is  shown  in  Figure  1. 

The  main  subsystems  of  the  system  are  as  follows  * 

Radar  -  This  subsystem  operates  in  both  the  Air  to  Air  and  Air  to 

Ground  roles . 

Radio  Altimeter  -  Functionally  self-evident. 

Inertial  8ensing  Unit  (1SU) 

-  This  subsystem  provides  outputs  of  aircraft  attitudes  and  3 
axis  speeds.  In  the  prime  mode,  horisontal  speeds  are 
derived  from  Doppler/Xnertial  mixing,  vertical  speed  from 
Barometric/ Inertial  nixing . 

Doppler  -  This  subsystem  provides  outputs  of  3  axis  speeds. 

Air  Data  Computer  -  This  subsystem,  besides  sensing  and  computing  of  Air  data 

parameters,  also  outputs  angle  of  attack  warning  data.  This 
data  has  two  forms  -  one  for  display  on  the  HUD  Pilot  Display 
Unit,  the  second  is  an  aural  output  to  the  aircraft  audio 
system  transmitted  via  the  HUD  Navigation  Control  Unit. 
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This  consists  of  5  units.  These  ere  the  Pilot  Display  Unit 
( PDU) ,  Electronics  Unit  (EU),  Navigation  Control  Unit  (NCU), 
NCU  Power  Supply  Unit  (NCUPSU)  and  Pilot  Control  Unit  (PCU). 


I 

HUD 


In  Figure  1,  the  NCU  is  shown  for  convenience  as  a  separate  unit.  In  fact,  the  NCU  is 
mounted  on  the  rear  face  of  the  PDU  as  is  shown  in  Pigures  2  and  3.  The  rear  face  of  the 
PDU  also  contains  other  HUD  controls.  The  NCU  and  other  controls  installed  on  the  rear 
face  of  the  PDU  provide  a  true  "Up  Front"  system  controller. 

Fast  selection  of  Air  to  Air  Mode  is  provided  by  2  pushbuttons  on  the  throttle.  Pushing 
one  or  both  (3  combinations)  causes  Air  to  Air  mode  to  be  selected  with  manual 
( stadiametric)  range  set  to  one  of  three  values.  At  the  same  time,  the  radar  begins  to 
search  and,  after  lock-on,  radar  range  is  used  by  the  HUD  replacing  the  selected  value  of 
manual  range. 

From  the  stick,  the  HUD  receives  inputs  of  Pickle  and  Trigger. 

The  prime  interface  in  the  system  is  a  digital  data  Bus  conforming  to  ARINC  429M,  the  M 
being  short  for  "modified".  The  principal  modification  to  the  ARINC  standard  was  to  make 
the  Bus  bi-directional  with  "handshake"  discretes  (Data  Transfer  Request,  Data  Transfer 
Accept)  introduced. 

Within  the  system,  all  weapon  aiming  and  navigation  computing  is  carried  out  in  the  HUD 
EU  with  the  exception  of  a  back-up  computation  of  present  position  which  is  carried  out 
by  the  ISU. 

4.  HUD  COMPOSITION 

As  stated  previously,  the  HUD  consists  of  5  units:  PDU  (with  NCU  attached),  EU,  NCUPSU 
and  PCU.  These,  with  the  exception  of  the  PCU,  are  illustrated  in  Figure  2. 

Entry  and  display  of  Navigation  data  is  achieved  using  the  NCU.  This  is  described  in 
more  detail  later. 

The  EU  contains  the  ARINC  429M  Bus  Controller. 

The  NCUPSU  contains  the  power  supply  for  the  NCU  plus  a  standby  Bus  Controller  which 
takes  over  automatically  when  the  HUD  is  switched  off.  This  enables  ISU  computed  present 
position  to  be  displayed  on  the  NCU  following  a  HUD  failure.  The  NCUPSU  also  supplies 
power  using  the  aircraft  battery  to  enable  long  term  data  storage  within  the  EU  when  the 
EU  power  is  disconnected.  Figure  3  shows  a  close-up  view  of  the  PDU /NCU  combination.  As 
can  be  seen  from  the  figure,  the  rear  face  of  the  PDU,  upon  trtiich  are  installed  the  NCU 
and  other  HUD  controls  at  the  top,  also  has  a  space  on  the  top  right  for  installation  of 
the  display  recorder  camera. 

The  controls  located  on  the  top  of  the  PDU  rear  face  consist  of  the  following: 

-  RAD  ALT / BARO/ TARGET  three  position  switch. 

This  selects  the  type  of  attitude  to  be  displayed  on  the  PDU.  (ie.  Radio,  Barometric 
or  Target).  With  TARGET  selected.  Altitude  may  be  set  using  the  potentiometer  below 
the  switch.  The  RAD  ALT/ BARO  positions  also  select  the  type  of  air  to  ground  ranging 
used  if  the  radar  is  not  locked. 

-  TARGET/ WGSN  potentiometer . 

This  is  used  to  set  the  Target  Barometric  Altitude  and,  in  the  Air  to  Air  mode,  to  set 
Target  Aircraft  wingspan.  The  values  are  shown  on  the  PDU. 

-  CAMERA  ON/OFF  two  position  switch. 

This  allows  manual  switch-on  of  the  display  recorder  camera. 

-  BPS  Potentiometer 

The  Barometric  Pressure  Setting  potentiometer  is  used  to  set  the  pressure  of  the  day 
in  millibars,  the  value  being  shown  on  the  PDU. 

-  HUD /OFF  switch  and  potentiometer. 

This  combined  switch  and  potentiometer  switches  on  the  HUD,  except  the  NCU.  and  allows 
adjustment  of  the  PDU  display  brightness. 

-  NCU/OFF/STBY  combined  switch  and  potentiometer. 

This  control  switches  on  the  NCU  and  allows  adjustment  of  the  NCU  display  brightness. 
After  data  has  been  loaded  using  the  NCU,  selection  of  the  standby  (8TBY)  position 
allows  the  data  to  be  retained  in  the  EU  mesK>ry  when  the  EU  power  is  disconnected. 

This  facility  allows,  for  example,  data  loaded  in  the  evening  to  be  used  for  a  mission 
the  following  day.  Use  of  the  standby  facility  is  Indicated  by  illumination  of  the 
green  Light  fisitting  Diode  installed  above  the  switch. 

-  NORM/DCL  (Normal /Declutter)  two  position  switch. 

Selection  of  Declutter  removes  some  of  the  symbols  from  the  PDU  display. 


Mode  selector  rotary  switch. 
Selectable  HUD  PDU  display  modes  are: 
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NAV 

Navigation 

APP 

Approach 

GEN 

General  Flying 

AA 

Air  to  Air  Guns  and  Missiles 

CCRP 

Continuously  Computed 

Release  Point 

CCIP 

Continuously  Computed 

Impact  Point 

The  Navigation  Control  Unit  (NCU)  controls  and  displays  are  located  at  the  bottom  of  the 
PDU  rear  face.  The  controls  and  displays  consist  of  illuminated  push  buttons  located  on 
a  legend-less  panel  and  two  opticators  for  data  entry  and  display. 

Conventional  NCU' a  using  rotary  switches  would  require  more  panel  space  to  fulfil  the 
same  functional  requirements  or,  putting  the  point  another  way,  use  of  illuminated  push 
buttons  enables  more  functions  to  be  placed  on  a  given  quantity  of  panel  space. 

The  legends  on  the  pushbuttons  and  examples  of  NCU  use  are  given  later  in  this  paper. 

Figure  4  shows  the  layout  of  the  PCU.  This  unit  is  installed  on  the  right  hand  side 
console  and  contains  the  least  used  control  functions  for  which  there  was  no  available 
space  on  the  rear  face  of  the  PDU.  The  unit  is  an  integrated  system  panel  and  contains 
the  following  controls 

A  rotary  switch  for  selection  of  ISU  mode. 

-  On-Board  Check  Out  System  (OBCOS)  control.  This  is  a  rotary  switch  for  selection  of 
self-test  of  the  NCU,  HUD,  ISU,  ADC  and  Doppler.  The  result  of  the  self  test  is 
displayed  on  one  of  the  NCU  opticators. 

Doppler  Off/ Land/Sea  three  position  mode  switch. 

HUD  standby  sight  On/Off  and  Brightness  Control. 

Angle  of  Attack  Warning  System  audio  volume  control. 

5.  MODIFICATIONS  TO  THE  BASIC  HUD/WAC 

In  order  to  convert,  as  it  were,  the  basic  HUD/WAC  into  a  HUD/WAC/NAV  fulfilling  the 
functional  requirements  specified,  a  number  of  changes  to  the  baseline  HUD/WAC  equipment 
were  necessary,  one  of  them  being  fundamental. 

The  necessary  changes  are  summarised  below: 

(a)  Changes  to  the  EU 

The  processor  was  changed  to  a  three  level  interrupt  type,  the  three  levels  being 
50Hz,  25Hz  and  5Hz. 

The  Digital  Data  Bus  was  changed  to  ARINC  429m. 

A  Bus  Controller  was  added  to  the  EU . 

The  number  of  analog  input  channels  was  increased. 

The  read/write  data  (scratchpad)  store  was  increased. 

Scratchpad  store  hold-up  by  aircraft  battery  was  added. 

The  EPROM  program  store  was  increased  in  order  to  provide  the  Navigation  Software. 
The  NCU  was  added  to  the  system,  it  being  under  control  of  the  EU. 

(b)  Changes  to  the  PDU 

The  NCU  was  added  as  an  "Up-Front"  controller  and  containing  a  Standby  Bus  Controller. 

(c)  NCUP8U 

This  was  added  to  the  system  to  provide  power  for  the  NCU  and  for  the  Standby  Bus 
Controller. 

(d)  PCU 

This  was  added  to  the  eystem  to  provide  the  least  used  controls.  That  is,  those  controls 
for  which  it  was  considered  lees  essential  to  be  provided  "Up-Front". 

6.  SYSTEM  WEAPON  AIMING  FACILITIES 

As  previously  stated,  my  paper  concentrates  principally  on  the  Navigation  aspects  of  the 
system.  For  completeness,  the  weapon  aiming  facilities  provided  are  summarised  in  this 
section. 

The  weapon  aiming  facilities  are  as  follows: 


(a)  Air  to  Ground 

Continuously  Computed  Impact  Point  (CCIP)  for  Bombs,  Guns  and  Rockets. 

Continuously  Computed  Release  Point  (CCRP)  for  Bombs. 

-  Ranging  using  Radar,  Radio  Altitude  or  Barometric  Altitude. 

(b)  Air  to  Air 

Guns  Snapshoot  using  radar  ranging  or  stadiametic  ranging. 

Maximum  and  Minimum  range  computation  and  display  for  Missiles. 

7.  SYSTEM  NAVIGATION  FACILITIES 

This  section  describes  the  Navigation  facilities  provided  by  the  overall  system.  The 
navigation  facilities  are  numerous  and  relatively  sophisticated  as  can  be  seen  from  the 
description  below. 

Latitude/Longitude  coordinates. 

-  Up  to  18  waypoints  are  provided  of  which  4  are  for  storage  of  overflown  points  on 
the  ground  (eg,  targets  of  opportunity  or  similar  points  of  interest). 

Storage  within  the  EU  of  the  coordinates  of  10  pre-programmed  destinations.  These 
are  coiwnonly  used  waypoints  and  may  be  called  up  as  a  waypoint  in  the  aircraft  route 
plan. 

Speeds  used  for  Navigation  are  Doppler/ Inertial  or  Pure  Inertial  in  the  prime  mode 
backed  up  by  Baro/lnertial  following  Doppler  failure  or  if  the  Doppler  stays  in 
memory  for  an  excessive  period  of  time.  A  last  ditch  back-up  mode  is  use  of  air 
data  navigation  following  a  partial  failure  of  the  ISU. 

Provision  on  the  PDU  of  a  flight  director  for  guidance  along  the  track,  real  or 
offset,  joining  the  current  To/From  destinations  or,  in  the  Intercept  Sub-mode  of 
Navigation,  guidance  to  intercept  an  airborne  target.  The  flight  director 
mechanisation  uses  a  track  hold  control  law  computed  in  the  HUD  EU. 

Pilot  selectable  display  on  the  NCU  of  one  of  the  following; 

o  Present  Position 

o  Waypoint  Coordinates 

o  Distance  and  bearing  to  the  current  destination 
o  Coordinates  of  the  pre-programmed  destinations 
o  Ground speed  and  track 

o  Cross-track  error  concerning  the  current  To/Frora  waypoints, 
o  Current  Windspeed  and  Direction 

o  Fuel  and  Time  necessary  to  fly  between  any  2  waypoints  either  by  direct  flight 
or  by  following  the  planned  route. 

o  Fuel  and  time  necessary  to  fly  to  the  next  destination  from  present  position. 

o  In  the  Attack  Sub-mode,  the  estimated  time  of  day  of  arrival  at  the  entry  point 
of  the  attack.  In  order  to  assist  the  pilot  to  arrive  at  the  entry  point  of  a 
planned  attack  at  the  desired  time,  a  speed  error  symbol  is  displayed  on  the  PDU. 

o  Weapons  carried  on  the  mission  (shown  on  the  PDU). 

o  Mission  route  plan  (shown  on  the  PDU). 

-  Pilot  selectable  automatic  or  manual  destination  change. 

Planned  Pix  on  a  waypoint  or  Random  Fix,  both  by  overflight. 

Data  entry  either  manually  or  using  an  automatic  data  loader. 

-  Data  entry  of 

o  Waypoint  coordinates.  Waypoints  can  be  random  or  use  can  be  made  of  the  already 
stored  pre- programed  destinations. 

o  Nominal  ground speeds  and  fuel  consumption  rates  pertaining  to  each  leg  of  the 
route  plan. 


o  Time  of  Day. 
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o  Attack  sub-mode  data,  including  desired  time  of  arrival  at  the  attack  entry, 
o  Intercept  sub-mode  data . 
o  Mission  route  plan  (shown  on  the  PDU)  . 
o  Windspeed  and  direction, 
o  Random  fix  data 

o  Desired  left  or  right  offset  from  track. 

o  Magnetic  Variation  and  runway  Magnetic  Heading  for  the  reference  mode  of  ISU 
alignment . 

o  Mission  weapon  data. 

In  the  event  of  HUD  failure,  back-up  Present  Position  calculated  within  the  ISU 
and  displayed  on  the  NCU. 

8.  NCU  OPERATION 

In  this  section,  the  operation  of  the  NCU  controls  is  described  in  some  detail  and 
illustrated  by  two  examples.  The  NCU  is  used  for  entry  and  display  of  navigation  and 
other  data  and  is,  we  believe,  an  elegant,  unique  solution  to  a  complex  problem. 

8.1  Layout  of  the  Controls  and  Displays 

Shown  in  Figure  5  is  the  layout  of  the  NCU  with  all  pushbutton  legends  illuminated.  This 
is  a  situation  which  never  happens  in  practice  since  the  illumination  of  the  legends,  or 
not  as  the  case  may  be,  is  completely  under  the  control  of  the  EU  software  Which  allows 
illumination  of  only  those  legends  which  are  available  for  selection  at  the  particular 
time  during  the  flight  or  during  the  particular  phase  of  NCU  usage.  Additionally,  some 
functions  are  mutually  exclusive.  Por  example,  FIDO,  the  automatic  data  loader,  is 
available  for  selection  only  before  wheels  up.  A  second  example  concerns  the  MAN/AUTO 
pushbutton.  This  refers  to  the  type  of  destination  change,  either  manual  or  automatic. 
These  are  obviously  mutually  exclusive  and,  therefore,  only  MAN  or  AUTO  will  be  lit  at 
any  one  time.  Change  from  MAN  to  AUTO,  or  vice  versa,  is  achieved  by  pushing  the  button. 
As  a  third  example,  selection  of  AUTO  causes  the  CHANGE  DEST  key  to  be  blanked. 

Referring  to  Figure  5,  it  can  be  seen  that,  for  descriptive  purposes,  the  NCU  controls 
and  displays  may  be  considered  as  consisting  of  four  parts: 

Functional  Pushbutton  Group 
Keyboard 

-  Small  Opticator 
Large  Opticator 

(a)  Functional  Pushbutton  Group 

This  is  the  group  of  10  pushbuttons  located  above  the  two  opticators.  The  following 
functions  are  provided: 

Selection  of  destination  change  type  (MAN  or  AUTO) 

Selection  of  the  Attack  and  Intercept  submodes  of  Navigation  (ATK  or  I NT ) 

-  Automatic  data  loader  operation  (FIDO) 

-  Manual  Destination  Change  (CHANGE  DEST) 

Storage  of  the  coordinates  of  overflown  points  (STORE  POS) 

-  Fixes  (PLANFIX,  RANDFIX) 

Selection  of  Whether  the  NCU  will  be  used  for  display  of  data  or  programming 
(entry)  of  data  ( DISPLAY/PROGRAM) 

(to)  Keyboard 

This  is  a  group  of  12  pushbuttons.  The  lower  halves  of  each  pushbutton  are  used  for 
entry  of  numerical  and  other  data.  The  upper  halves  are  used  to  select  the  type  of  data 
to  be  displayed  or  programmed. 

(c)  Small  Opticator 

This  is  a  three  "window"  alphanumeric  display  used  to  give  messages  to  the  pilot 
concerning,  for  example,  system  status  or  0BC0S  results. 

(d)  Large  Opticator 

The  large  opticator  is  used  for  display  of  the  data  requested  by  the  pilot,  for  example 
present  position,  or  to  hold  keyboard  entered  data  during  programming  operations  of  the 
NCU. 


8.2  NCU  Display  Example 

Figure  6  shows  the  appearance  of  the  NCU  in  the  Display  8elect  mode.  As  no  data  is  to  be 
entered,  the  numerical  part  of  the  keyboard  is  blanked  while  the  small  opticator  shows 
that  we  are  flying  frcm  waypoint  3  to  waypoint  1  with  the  Doppler  in  memory.  The  top 
halves  of  the  keyboard  show  the  menu  of  displays  available  for  selection. 
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Suppose  that  display  of  Present  Position  is  desired.  The  pilot  pushes  POS  and  the  NCU 
appearance  becomes  as  shown  in  Figure  7  with  Present  Position  shown  in  the  large 
opticator.  Of  the  available  display  selections,  only  POS  remains  illuminated  as  a 
reminder  of  the  data  being  displayed.  A  further  push  of  POS  returns  the  NCU  to  display 
select  mode. 

8.3  NCU  Program  Example 

From  the  display  of,  for  example,  Present  Position,  as  shown  in  Figure  7,  the  pilot 
presses  DISPLAY  and  the  NCU  appearance  changes  tc  the  Program  Select  mode  as  illustrated 
in  Figure  8.  DISPLAY  has  changed  to  PROGRAM  and  the  menu  of  programs  available  is 
indicated  in  the  upper  halves  of  the  keyboard  pushbuttons. 

Suppose  that  the  loading  of  waypoint  coordinates  is  desired.  The  pilot  presses  DEST  and 
the  NCU  appearance  changes  to  that  shown  in  Figure  9.  Of  the  program  menu,  only  DEST 
remains  illuminated  and  the  letter  D  has  appeared  in  the  small  opticator  as  a  reminder 
that  the  next  task  is  the  entry  of  the  destination  (or  waypoint)  number.  The  keys  0  and 
1  are  illuminated  ready  for  the  entry  of  the  first  digit  of  the  waypoint  number  which 
must  be  a  0  or  a  1 . 

After  entry  of  the  waypoint  number,  the  NCU  appearance  changes  to  that  shown  in  Figure  10 
in  which  a  waypoint  number  06  has  been  entered. 

The  next  task  is  to  ACCEPT  or  REJECT  this  data  by  pushing  the  appropriate  button. 

If  accepted,  the  next  task  is  to  load  the  coordinates  of  waypoint  6  as  shown  in  Figure  11 
following  which  a  further  ACCEPT  completes  the  entry  of  the  waypoint  number  and  its 
coordinates . 

(Note:  The  REJECT  key  is  red  when  illuminated  on  the  real  NCU  and,  therefore,  may  not 
appear  to  be  illuminated  in  Figures  10  and  11  because  of  reproduction  in  black  and 
white) . 


8.4  Small  Opticator  Middle  Window  Indication  Examples 

Section  8.^  has  given  one  example  of  how  the  small  opticator  is  used  during  data  loading 
using  the  NCU. 

Illustrated  in  Figure  12  are  some  examples  of  the  appearance  of  the  middle  "window"  of  > 

the  small  opticator  when  it  displays  system  status  during  normal  flight  -  that  is,  when 
the  NCU  is  not  in  Program  mode. 

The  referenced  figure  is  self-explanatory  except  for  the  example  given  at  the  bottom 
which  indicates  that  we  are  flying  from  waypoint  3  to  waypoint  2  with  the  D.jppler 
currently  ii.  memory. 

8 . 5  Small  Opticator  OBCOS  Indications 

The  appearance  of  the  small  opticator  during  self-test  of  the  subsystem  selected  using 
the  OBCOS  control  located  on  the  PCU  is  shown  in  Figure  13. 

9.  TESTING  OF  THE  NAV/ ATTACK  SYSTEM 

This  section  of  the  paper  describes  briefly  the  philosophy  of  integration  and  flight 
testing  of  the  overall  prototype  Nav/Attack  system. 

The  testing  comprises  six  phases  as  follows: 

Phase  1 

Each  subsystem  was  acceptance  tested  before  leaving  its  factory  for  delivery  to  the 
systems  integration  and  test  rig  site . 

Phase  2 

Upon  arrival  at  the  rig  site,  each  subsystem  was  subjected  to  an  identical  acceptance 
test  using  identical  test  equipment. 

Phase  3 

Progressive  Integration  Testing  of  the  system  on  the  rig  against  written  teat  procedures. 

In  the  context  of  integration  testing,  the  word  "progressive"  means  that  the  subsystems 
were,  where  possible,  first  tested  in  pairs,  then  triplets  etc. 

Phase  4 

Ground  test  of  the  system  on  the  trials  aircraft  against  a  written  ground  test  procedure. 

Phase  5 

Flight  Test.  The  flight  test  phase  was  essentially  qualitative  in  that  virtually  no 
performance  measurements  were  taken.  The  objective  was  to  prove  that  the  system  was 
functioning,  but  not  in  terms  of  accuracy  measurements. 

Phase  6 

Flight  Trials.  This  phase  is  quantitative  and  will  determine  the  accuracies  of  the 
Navigation  and  Weapon  aiming  modes. 


For  the  latter  part  of  the  Flight  Test  phase  and  for  the  Flight  Trials  phase,  an  Airborne 
Data  Recorder  (ADR)  was  installed  on  the  aircraft  to  record  from  the  data  bus.  The  EU 
software  was  also  modified  to  output  special  parameters  onto  the  data  bus  for  recording 
purposes.  Since  no  instrumented  range  was  available,  other  techniques  had  to  be 
developed  for  accuracy  testing.  These  techniques,  allied  with  the  ADR  and  its  associated 
ground  equipment,  enable  satisfactory  flight  trials  analysis. 

At  the  time  of  writing,  the  project  is  entering  the  Flight  Trials  phase. 

10.  CONCLUSION  AND  FUTURE  TRENDS 

In  conclusion,  this  paper  has  described  briefly  a  HUD/WAC/NAV  system  built  to  satisfy  the 
requirements  of  an  overseas  customer.  Integration  of  Navigation  and  Fire  Control  within 
a  HUD  has  been  shown  in  testing  to  be  a  viable  concept.  In  particular,  the  NCU  approach 
of  using  illuminated  pushbuttons  is  an  elegant  solution  to  the  problem  of  providing  a 
complex  navigation  control  and  display  unit  in  a  limited  space  and  of  locating  such  a 
device  where  it  belongs,  "Up-Front This  is  due,  in  particular,  to  the  fact  that  no 
dedicated  panel  engravings  are  necessary. 

For  the  future,  we  have  to  pose  the  question  - 

“Are  we  heading  towards  central  computing  with  more  and  more  functions,  which  have 
historically  been  separated,  integrated  into  one  subsystem?" 

However,  it  seems  likely  that  such  integration  should  be  limited  to  those  system  LRU's 
and  sensors  which  are  required  to  operate  in  a  co-operative  manner  to  achieve  a  given 
function  and  one  will  certainly  not  see  a  widespread  integration  crossing  many  different 
boundaries  of  redundancy,  integrity  and  performance  such  as  by  integrating  flight 
control,  engine  control,  navigation,  stores  management,  etc,  all  into  a  single  computing 
complex,  however  all  encompassing  the  theoretical  integrity  of  such  a  complex  might  be. 
Not  only  would  such  a  system  be  highly  expensive  because  of  the  need  to  design  every 
system  up  to  the  level  of  the  most  demanding,  but  it  poses  what  are  presently  insoluble 
problems  in  the  field  of  common  mode  failures. 

Therefore,  as  a  basic  systems  design  technique,  I  do  not  believe  that  we  are  moving  back 
towards  the  original  central  computer  complex.  On  the  other  hand,  in  the  area  of 
aircraft  weapon  system  retrofit,  where  one  is  adding  one  or  two  quite  distinctive 
features  to  an  existing  aircraft,  or  integrating  some  of  the  existing  functions  within 
the  aircraft,  it  seems  possible  to  adopt  the  benefits  of  central  computing  systems  whilst 
at  the  same  time  maintaining  the  existing  levels  of  redundancy  and  integrity  which  are 
available  within  the  basic  aircraft  to  which  these  new  functions  are  being  added. 
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DOPPLER,  INERTIAL  NAVIGATION  IN  PROGRESS 

PURE  INERTIAL  NAVIGATION  IN  PROGRESS  BECAUSE  DOPPLER  IS  IN  MEMORY 
AFTER  ABOUT  S  MINUTES  ISU  SWITCHES  TO  BAROANERTlAL  MOOE 

PURE  INERTIAL  NAVIGATION  IN  PROGRESS  BECAUSE  DOPPLER  HAS  FAILED 

PURE  INERTIAL  NAVIGATION  IN  PROGRESS  BECAUSE  OOPPLER  NOT  TRANSACTING 
OR  OFF  AFTER  ABOUT  6  MINUTES  ISU  SWITCHES  TO  BAROANEOTMl  MOOE 

BARG,  INERTIAL  NAVIGATION  IN  PROGRESS 

HUO  AIR  DATA  NAVIGATION  IN  PROGRESS 

AUTOMATIC  NAVIGATION  NO  LONGER  AVAILABLE 

HUD  FAIL 


J  EXAMPLE 


3lMl5 


Figure  12  Small  Opticator  Middle  "Window*  Indication  Examples 
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Figure  13  Small  Opticator  OBCOS  Indications 
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/  SUMMARY 

^The  transition  from  mechanical  to  redundant  digital  electronic  flight  controls  started  in  1950  and  is 
at  a  rather  advanced  state.  The  first  few  full  authority  digital  electronic  engine  control  systems  have 
completed  initial  development.  Many  of  the  control  laws  and  redundancy  management  techniques  that  were 
pioneered  in  flight  controls  are  directly  applicable  to  digital  engine  controls. 


Section  1  outlines  the  authors’  recommended  system  design  approach.  Section  2  discusses  some 
considerations  for  the  design  of  electronically  implemented  control  laws.  Section  3  describes  a  typical  re¬ 
dundancy  management  concept,  based  on  digital  flight  control  techniques,  for  a  quadruplex  engine  control 
system.  This  is  followed  by  the  authors'  recommended  analysis  methodology  to  determine  the  probability 
of  control  system  failure.  The  conclusion  of  Section  3  discusses  some  implications  that  use  the  probability 
theory  has  on  the  control  system  design  requirements.  Section  4  discusses  the  recommended  integration, 
development  test  and  validation  test  approach  of  the  authors.  ^ 

1  GENERAL  CONTROL  SYSTEM  DESIGN  PHILOSOPHY 


1.1  Engine  Control  System  History 

The  first  turbine  engine  became  operational  less  than  50  years  ago.  Comparing  today's  sophisti¬ 
cated  hydromechanical  turbine  control  system  to  the  comparatively  simple  turbine  control  oi  the  first 
engine  shows  the  tremendous  progress  made  in  the  turbine  controls  field.  This  progress,  in  our  opinion, 
will  be  overshadowed  by  the  progress  that  will  be  made  in  the  next  three  to  six  years  with  the  new 
digital  engine  controls. 

A  turbine  engine  is  a  device  that,  unless  controlled  in  an  exact  manner,  has  the  tendency  to  self- 
destruct.  Control  must  be  obtained  in  a  reliable,  efficient  and  cost  effective  manner.  In  many  ways  this 
is  similar  to  the  control  of  an  unstable  aircraft  with  which  the  authors  are  more  familiar  than  turbine 
engine  controls.  However,  the  application  of  digital  control  techniques  and  redundancy  management  con¬ 
cepts  demonstrated  in  flight  controls,  as  well  as  the  lessons  learned  in  flight  controls,  are  directly  appli¬ 
cable  to  engine  controls. 

1.2  Hydromechanical  Control  System  Design  Priorities 

To  adequately  control  a  turbine  engine  is  always  a  difficult  job.  This  was  especially  true  in  the 
early  days  of  turbine  engine  control  work.  There  was  little  analytical  basis  for  the  control  work  and 
experimentation  formed  much  of  the  basis  for  early  control  systems.  Out  of  these  experiences  came  the 
control  system  priorities  that  still  hold  true  for  today's  hydromechanical  controls: 

1.  Engine  protection  against  self-inflicted  damage  for  self-destruction  from: 

a.  Temperature  limits  being  exceeded 

b.  Speed  limits  being  exceeded 

c.  Pressure  limit  being  exceeded 

2.  Engine  stability  is  lost  as  expressed  in: 

a.  Engine  thrust  fluctuations 

b.  Fan  and  compressor  stall  margins 

c.  Augmentor  spikes 

3.  Compatibility  with  aircraft  inlet  to  satisfy  engine  requirements  for: 

a.  Airflow  corridor 

b.  Minimum  burner  pressure 

4.  Steady-State  performance  and  accuracy  of  engine  with  regard  to: 

a.  Thrust  modulation 

b.  Thrust  and  fuel  consumption  requirements 

c.  Control  sensitivity 

d .  Repeatability 

5.  Transient  requirements  of  total  engine  to  assure: 

a.  Thrust  is  a  monotonic  function  of  time  for  monotonic  throttle  command 

b.  Acceleration  and  deceleration  times  are  reasonable  and  repeatable 

c.  Combustion  stability  is  always  present 


6.  Reliable  start  and  transition  to  normal  operation  la  available 

7.  Engine  maintenance  is  minimum  and  can  be  performed  in  a  reasonable  manner. 


It  is  the  authors'  opinion  that  prioritizing  digital  electronic  control  system  requirements  in  this 
manner  can  be  detrimental  to  a  successful  digital  electronic  control  system.  It  is  expected  that  proper 
use  of  the  digital  processors  (with  the  necessary  help  of  advanced  multi -variable  controls  theory)  will 
make  it  possible  to  meet  al!  these  criteria  without  necessarily  assigning  a  priority  order  and  without 
sacrificing  overall  safety  or  performance  at  any  point  in  the  flight  envelope. 

1.3  Control  System  Design  Procedure 

The  recommended  design  procedure  is  shown  schematically  in  Figure  1.1,  Control  System  Design 
Integration  and  Validation  Flow  Diagram.  It  describes  the  method  used  by  the  authors  in  design  of  flight 
control  systems.  It  is  felt  that  this  method  would  be  applicable  to  engine  control  in  the  same  manner  as 
to  flight  controls. 

1.3.1  Concept  Development 

Any  control  system  has  three  major  requirements:  The  first  is  the  functional  requirements  which 
relate  to  the  plant  that  must  be  controlled.  The  second  is  the  environmental  considerations  which  must 
be  specified  to  ensure  the  survivability  of  the  control  system.  The  third  is  the  related  probability  of 
operation  of  the  control  system  which  is  especially  applicable  if  there  are  redundant  control  modes. 

The  functional  control  law  characteristics  determine  the  engine  efficiency,  utility,  response  charac¬ 
teristic  and  performance.  These  characteristics  are  obtained  by  synthesizing  the  control  laws  and  are 
validated  by  analysis  in  the  design  phase  and  by  testing  prior  to  actual  use  on  the  engine.  The  environ¬ 
mental  characteristics  specified  under  which  the  control  system  components  must  survive  are  determined 
by  the  location  of  the  components  on  the  engine  and/or  with'n  the  airplane.  These  considerations  influ¬ 
ence  the  basic  selection  of  the  control  system  components  that  can  be  used.  They  also  affect  the  overall 
control  system  architecture. 

Probability  of  engine  operation  requirements  are  specified  as  the  allowable  probability  of  loss  of 
engine,  probability  of  allowable  mission  abort,  and  probability  of  damage  to  the  engine  due  to  engine  con¬ 
trol  system  failure.  The  specified  requirements  can  be  used  by  the  control  system  designer  to  determine 
the  required  fault  tolerant  approach  to  meet  the  design  goals  for  a  fly-by-wire  engine  control  system. 
Redundancy  considerations,  in  conjunction  with  the  reliability  of  the  individual  subsystems,  form  the  basis 
of  the  engine  operational  readiness,  the  probability  of  operation,  the  probability  of  mission  abort,  as  well 
as  maintenance  and  life  cycle  costs  o  *he  engine. 

Applying  probability  numbers  based  on  Mean  Time  Between  Failure  (MTBF)  data  of  components  and/ 
or  subsystems  to  determine  probability  of  engine  loss,  etc.,  has  severe  implications  on  the  requirements 
for  Continuous  Built  In  Test  (CBIT)  and  Initiated  Built  In  Test  (1BIT)  of  the  engine  control  system. 
The  standard  practice  of  using  MTBF  data  in  control  system  probability  analysis  subtly  implies  that  prior 
to  each  flight  the  control  system  is  completely  checked  to  verify  that  no  latent  failures  are  present  in  the 
system.  In  addition,  failures  that  occur  and  have  provisions  for  failure  isolation  and  system  reconfigura¬ 
tion  must  be  identified  and  the  system  must  be  reconfigured.  These  CBIT  and  IBIT  test  requirements 
must  be  identified  and  implemented  as  part  of  the  fault  tolerant  design  of  the  engine  control  system. 

1.3.2  System  Definition  and  Development 

The  combination  of  functional  and  probability  of  operation  requirements  results  in  the  complete  defi¬ 
nition  of  the  conceptual  engine  control  system.  The  authors  feel  that  it  is  prudent  at  this  time  that  the 
initial  Failure  Modes  and  Effects  Analysis  (FMEA)  and  Single  Point  Failure  Analysis  (SPFA)  be  conducted 
to  determine  if  there  are  any  failure  modes  within  the  control  system  that  have  not  been  properly  ad¬ 
dressed.  Merely  conducting  a  single  point  failure  analysis  and  a  failure  modes  and  effects  analysis  is  not 
sufficient  since  it  only  identifies  potential  problem  areas  and  potential  solutions.  The  potential  solutions 
must  be  validated  through  testing  on  the  actual  engine  control  hardware  to  assure  that  the  conclusions 
derived  are  correct.  Therefore  it  is  important  that  the  testing  facility  be  available  that  has  the  ability  to 
validate  single  point  failure  analysis  results  and  failure  modes  and  effects  analysis  results. 

The  functional  analysis  results  must  be  validated  in  a  similar  manner  -  preferably  on  the  same  con¬ 
trols  test  stand.  The  method  proposed  here  for  functional  and  redundancy  management  verification  is  to 
construct  an  engine  controls  test  stand  that  will  allow  validation  of  control  systems  characteristics.  The 
definition  of  such  a  test  stand  must  be  considered  In  the  conceptual  engine  control  system  design.  The 
validation  of  the  control  system  operation  as  influenced  by  environmental  characteristics  is  done  as  part 
of  the  component  testing  and  is  not  considered  in  the  test  stand  design. 

After  the  conceptual  design  is  completed,  the  system  must  be  separated  Into  individual  line  replace¬ 
able  units  (LRUs)  must  be  done.  The  line  replaceable  units  are  computers,  actuators,  sensors,  etc., 
each  requiring  its  own  dedicated  specification.  Satisfactory  results  from  the  control  system  analysis,  the 
FMEA  and  the  SPFA  assure  that  the  specification  la  ready  for  vendor  selection  and  contract  negotiations. 
As  part  of  the  contract  award  negotiations,  s  definition  of  LRU  development  testing,  acceptance  testing, 
environmental  testing,  reliability  development,  and  life  testing  must  be  defined  and  made  a  part  of  the 
contract. 

1.3.3  Verification,  Validation,  and  Integration  Testing 

Baaed  on  the  authors'  experience  in  flight  control  systems,  it  seems  almost  impossible  to  integrate  a 
high  authority  digital  engine  control  system  or  flight  control  system  without  the  use  of  s  control  system 
test  stand.  A  generalised  block  diagram  of  such  a  control  test  stand  ia  shown  in  Figure  1.2.  A  control 
test  stand  ia  used  to  integrate  the  control  system  hardware,  perform  functional  validation  of  the  control 
laws  and  redundancy  management  Implementation  of  the  engine  control  system  design. 


Experience  in  flight  control  system  has  shown  that  it  is  extremely  important  to  perform  formal  test¬ 
ing  with  well-documented  and  rigidly  controlled  test  procedures.  It  is  helpful  to  perform  some  develop¬ 
ment  testing  prior  to  the  official  tests  in  order  to  assure  basic  system  operation  and  to  allow  identification 
and  resolution  of  early  fundamental  operation  problems.  Close  cooperation  is  required  between  the 
selected  LRU  vendors  and  the  buyer  to  assure  that  the  vendor's  development  test  procedures,  acceptance 
test  procedures,  environmental  test  procedures,  life  test  procedures,  and  the  buyer's  system  integration 
test  proced'”-«8,  development  test  procedures  and  validation  test  procedures  are  properly  coordinated. 
This  coon** nation  is  especially  important  for  the  design  of  the  integration  test  facility  at  the  buyer's 
facility,  wivich  places  special  requirements  on  many  of  the  individual  LRUs.  These  special  requirements 
will  require  extra  features  of  the  lab  test  units  to  allow  visibility  into  internal  operation  of  LRUs  to  aid  in 
problem  identification  and  debugging. 

The  test  stand  facility  must  serve  the  purpose  of  conducting  preliminary  trial  runs  of  tests  to  be 
conducted  at  a  later  date  on  the  engine  in  the  test  sell  or  on  the  aircraft.  Time  and  money  should, 
therefore,  be  saved  in  the  test  cell  and  aircraft  tests  by  debugging  the  test  plans  and  procedures  and  by 
allowing  the  test  ceil  and  aircraft  tests  to  be  checks  of  critical  points  and  a  verification  of  previous 
results . 

Satisfactory  completion  of  all  testing  on  the  engine  controls  test  stand  should  be  a  prerequisite  for 
the  control  systems  testing  in  the  engine  test  cell.  If  a  good  representation  of  the  thermodynamic  engine 
was  used  in  the  closing  of  the  control  loops  on  the  controls  test  stand,  the  test  results  of  the  engine  test 
cell  should  be  identical  to  the  results  obtained  on  the  test  stand.  This  in  turn  implies  that  the  test  cell 
operation  of  the  engine  control  system  and  the  total  engine  operation  is  a  validation  of  the  previously 
obtained  engine  controls  test  stand  results.  Proper  use  of  the  controls  test  stand  therefore  allows  the 
inexpensive  operational  use  of  the  engine  controls  test  stand  to  be  substituted  for  many  hours  of  expen¬ 
sive  test  cell  runs. 

The  test  procedures  used  and  validated  on  the  test  stand  can  also  be  used  on  the  engine  test  cell 
operation  and  engine  installation  testing  on  the  aircraft.  Again,  this  will  lead  to  further  cost  and  time 
savings  in  the  final  phases  of  the  program  when  time  is  generally  at  a  premium  and  delay  costs  are  high. 


2.  '’'’NOTIONAL  TURBINE  ENGINE  CONTROL  LAWS 

section  briefly  reviews  typical  current  Hydro-Mechanical  control  law  development  for  turbine 
eng'  d  gives  a  general  example  of  a  hydro-mechanical  control  law.  This  will  be  followed  by  a  dis- 

C»  A  expected  parallels  between  turbine  engine  control  and  flight  control  system  developments. 


2.1  Engine  Model  for  Control  Law  Discussions 

The  turbine  engine  model  selected  for  detail  discussion  of  the  control  laws  is  shown  in  Figure  2.1. 
It  is  an  afterburning,  two  stage  turbine  engine  with  the  sensors  and  actuation  system  controls  identified. 
The  engine  is  typical  of  those  used  in  current  generation  fighters. 


2.2  Typical  Hydro-Mechanical  Control  Law  Concept 

Current  turbine  engine  control  systems  schedule  the  inlet  fan  vane  guides  and  high  pressure 
compressor  vane  guides  as  a  function  of  component  corrected  speeds.  These  schedules  are  derived  from 
component  tests  and  are  designed  to  maximize  component  efficiencies  along  the  operating  lines  which  will 
assure  adequate  stall  margins  for  even  the  most  severe  operating  conditions  anticipated. 

The  fuel  control  is  similarity  designed  to  schedule  fuel  flow  as  a  function  of  RPM,  engine  pressures, 
engine  temperatures,  static  pressure,  free  air  temperature  and  Mach  number  to  assure  that  none  of  the 
operating  limits  of  the  turbine  engine  will  be  exceeded  and  the  required  operational  characteristics  are 
maintained . 

The  general  approach  used  in  hydro-mechanical  controls  is  to  use  a  "predictor"  control  law  that 
predicts  in  advance  the  desired  vane  guide  position,  nozzle  position  or  fuel  flow  desired  based  on  pres¬ 
sure,  temperature  or  other  sensor  signals. 

In  brief,  this  design  approach  is  well  understood  by  the  engine  controls  community  and  has  a  large 
data  base  to  support  its  use.  The  hydro-mechanical  control  computers  development  in  support  of  this 
control  concept  are  an  outstanding  engineering  achievement  representing  a  mature  technology. 


2.3  Recommendations  for  Digital  Electronic  Turbine  Control  Laws 

The  potential  performance  improvements  obtainable  by  modem  electronic  control  systems  in  increased 
thrust  over  the  flight  envelope,  improved  Specific  Fuel  Consumption  (SFC),  improved  probability  of 
Mission  Success,  lower  probaoility  of  engine  damage  and  engine  loss  and  the  promise  of  lower  develop¬ 
ment,  acquisition,  operating  and  life  cycle  cost  will,  in  the  authors'  opinion,  make  the  current  approach 
obsolete. 


However,  digital  electronic  computers  show  only  small  advantages  when  incorporating  conventional 
engine  control  laws  into  a  digital  hardware/software  architecture.  This  can  be  vastly  improved  by  adding 
an  electronic  control  law  concept  which  also  uses  command  position  (or  fuel  flow)  to  drive  the  plant  to  be 


controlled  to  desired  operating  conditions  and  U  implemented  by  following  several  guidelines  used  in  the 
development  of  digital  flight  control  systems.  The  following  guidelines  should  be  observed: 

1.  The  design  approach  should  lend  itself  to  small  amplitude  -  piecewise  linear  systems  analysis 
using  either  state  variable  or  complex  plane  techniques. 

2.  The  limit  functions  should  be  excluded  from  the  control  law  analysis.  The  inclusion  of  limit 
functions  prohibits  initial  use  of  linear  analysis,  which  is  a  very  powerful  tool  for  validating  the 
initial  design  concept.  Table  2.1  shows  a  list  of  38  limit  functions  required  for  a  generalized 
two  spool  engine.  Any  or  all  of  these  limits  can  be  functions  of  multiple  variables  used  or  not 
used  in  the  primary  engine  control  laws. 

3.  The  linear  analysis  should  be  followed  by  time  domain  non-linear  analysis  to  evaluate  the  effects 
of  limit  functions  and  other  nonlinearities. 

4.  Actuator  control  loops  should  be  designed  to  be  single  command /feedback  functions  with  only 
one  summing  junction  in  the  loop  structure.  Reduction  of  the  actuation  system(8)  to  first  or¬ 
der,  second  order  or  third  order  linear  system  must  be  possible. 

2.4  Recommended  Interface  Between  the  Hydro-Mechanical  and  Digital  Flight  Control  Subsystems 

Designing  control  laws  based  on  the  preceding  recommendations  is  expected  to  produce  superior 
performance  over  the  hydro- mechanical  system.  However,  since  the  new  control  laws  and  mechanization 
have  not  been  proven  to  date,  it  is  advantageous  to  build  the  initial  systems  such,  that  the  control  laws 
of  the  electronic  system  are  in  control,  but  the  hydro-mechanical  control  system  is  also  active  and  ready 
to  take  over  should  the  electrical  system  perform  unsatisfactorily  or  even  fail.  By  the  same  token,  it 
must  be  possible  to  disconnect  the  hydro- mechanical  system  if  that  portion  of  the  system  should  fail. 
This  switching  concept  is  shown  in  Figure  2.2.  For  the  case  shown,  the  inlet  Fan  Vane  control  and  HPC 
Vane  control  is  spring-loaded  to  the  hydro-mechanical  control.  By  applying  hydraulic  pressure  to  the 
transfer  valve  the  electrical  control  mode  is  selected.  There  are  independent  loop  closures  for  the 
electrical  and  hydro-mechanical  actuation  system.  Through  the  use  of  the  transfer  valve,  either  loop 
closure  can  be  selected. 

3.  REDUNDANCY  MANAGEMENT  CONSIDERATION 

This  section  first  describes  a  typical  redundancy  management  concept  used  in  quadruplex  digital 
control  systems.  This  is  followed  by  an  example  of  probability  analysis  applied  to  such  a  quadruplex 
control  system.  The  conclusion  of  this  chapter  discusses  the  authors'  approach  to  probability  of  opera¬ 
tion  specification  for  a  control  system,  some  implications  that  use  of  probability  theory  imposes  on  the 
system  design  and  the  definition  of  the  authors'  "cost  effective"  design  goals. 

3.1  Typical  Redundancy  Management  Concepts  for  Quadruplex  Digital  Processor  Systems 

One  of  the  desirable  features  of  a  digital  processor  is  its  capability  to  process  large  amounts  of 
data,  perform  complex  computations,  and  make  complex  logic  decisions  in  an  efficient  manner.  The  unde¬ 
sirable  part  about  the  digital  processor  is  its  failure  modes.  First,  these  failure  modes  can  be  cata¬ 
strophic  at  any  time  without  prior  warning.  This  is  in  contrast  to  a  mechanical  system  where  failures  are 
normally  preceded  by  detectable  wear,  leaks,  or  degraded  performance.  Second,  there  are  many  failure 
modes  that  allow  basic  operation  of  the  processor,  but  do  not  allow  performing  the  computations  and  the 
desired  logic  decisions  in  the  manner  required  by  the  system  design. 

3.1.1  Built  in  Test  Concept 

The  problem  of  the  processor  operating  but  coming  up  with  wrong  solutions  can  be  handled  by 
using  a  well -structured  and  dedicated  method  of  testing.  One  should  realize  that  a  unique  feature  of  the 
digital  processor  is  its  capability  of  determining  if  the  last  set  of  computations  performed  by  the  proces¬ 
sor  were  performed  correctly.  This  is  accomplished  by  a  testing  method  commonly  called  built-in  tests 
(BIT).  BIT  can  be  separated  into  two  parts;  continuous  BIT  (CB1T),  which  is  run  any  time  the  func¬ 
tional  algorithms  are  being  executed,  and  initiated  BIT  (IBIT),  which  is  run  when  power  is  first  turned 
on  or  when  selected  by  ground  crew  or  pilot. 

The  concept  of  continuous  BIT  and  initiated  BIT  must  be  an  integral  part  of  the  control  system 
design.  It  is  not  a  feature  that  can  he  added  on  at  a  later  time,  but  must  be  considered  in  the  initial 
system  design.  The  hierarchy  of  a  redundancy  management  system  starts  with  the  digital  processors. 
Once  the  processors*  operation  has  been  verified  all  the  interfaces  between  the  digital  processors  and 
between  each  processor  and  the  outside  world  are  tested.  After  that  testing  has  been  completed  satisfac¬ 
torily,  testing  Is  extended  to  the  sensors  and  their  interfaces,  the  actuators  and  their  interfaces,  and 
also  the  discrete  signals  and  their  interfaces. 

The  continuous  BIT  is  running  continuously  and  checks  the  normal  operation  of  the  control  system. 
The  initiated  BIT  checks,  in  addition  to  the  normal  operation,  such  items  as  failure  detection  monitoring 
circuits,  control  system  reconfiguration  circuits,  and  display  interfaces.  Failure  to  pass  these  tests  leads 
In  general  to  the  disabling  of  the  affected  system  portion(s). 

A  generally  accepted  philosophy  is  that  a  digital  processor  can  declare  only  itself  as  failed.  It  is 
considered  imprudent  to  allow  the  other  processors  to  declare  a  particular  processor  failed.  Considering 
the  amount  of  self-testing  that  is  possible  In  a  digital  processor,  the  authors  feel  that  this  is  a  proper 
decision . 
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A  typical  series  of  tests  conducted  by  the  digital  processor  to  assure  its  operational  status  is: 

1.  A  watchdog  type  monitor  in  the  computer  hardware  that  is  of  the  "dead  man"  switch  type. 

2.  A  PROM  memory  test  that  performs  a  check  sum  of  the  memory  and  compares  it  against  a  stored 
number  indicating  the  correct  check  sum. 

3.  A  separate  computation  involving  all  the  microcode  instructions  of  each  individual  processor. 
The  correct  results  of  the  computation (s)  is  stored  and  compared  to  the  actual  results  obtained. 

4.  A  parity  check  that  verifies  the  validity  of  data  previously  stored  prior  to  its  use. 

5.  A  pattern  check*  of  the  RAM  memory. 

6.  A  pattern  check*  of  the  digital  processor  bus  system  and  the  registers. 

7.  A  check  of  the  power  supply  within  the  control  system. 

*  NOTE: 

A  pattern  check  consists  of  writing  all  zeros  into  the  desired  locations  and  then  reading  the  infor¬ 
mation  back  out  to  assure  that  the  input  and  output  information  is  identical.  This  process  is 

repeated  with  all  ones,  alternate  zeros  and  ones,  alternate  ones  and  zeros,  alternate  zeros  and  ones 

in  pairs,  and  alternate  ones  and  zeros  in  pairs. 

If  a  processor  can  perform  all  the  indicated  functions  for  continuous  BIT  correctly,  the  processor 
can  be  assumed  to  be  working  with  a  very  high  degree  of  confidence.  Once  the  processor  is  operating 
satisfactorily,  the  next  step  is  to  test  the  interfaces  from  the  digital  processor  to  the  outside  world. 
These  interfaces  are: 

1.  The  analog  to  digital  and  digital  to  analog  converter 

2.  The  discrete  input  and  output  signal  interface  system 

3.  The  intercommunication  systems  between  digital  processors  typically  called  the  cross  channel 
data  links. 

4.  The  MIL-STD-1553  bus  if  such  a  device  is  part  of  the  system. 

3.1.2  Built  in  Test  Applications 

The  analog  to  digital  (A  to  D)  and  digital  to  analog  (D  to  A)  converter  continuous  built-in  test  is 
best  described  with  reference  to  Figure  3.1.  This  test  uses  a  dedicated  wrap-around  test  loop  and  the 
previously  described  test  patterns  that  were  used  in  the  RAM  memory  testing.  The  digital  processor  uses 
the  test  pattern,  one  at  a  time,  and  sends  the  data  out  through  the  D  to  A  converter.  The  wrap-around 
test  loop  is  activated  and  the  analog  data  transfers  directly  through  a  buffer  amplifier  to  the  analog  to 
digital  converter.  The  analog  to  digital  converter  receives  the  digitized  data  and  verifies  that  the  data  is 
within  tolerance.  Typical  tolerance  is  +2  least  significant  bits.  By  using  all  test  patterns  and  obtaining 
satisfactory  results  the  normal  operation  of  the  A  to  D  and  D  to  A  converter  is  assured. 

The  discrete  signal  interface  system  is  best  described  with  reference  to  Figure  3.2.  This  system 
also  uses  a  wrap-around  test  similar  to  the  analog  to  digital  and  digital  to  analog  converter  wrap-around 
loop.  The  discrete  signals  coming  into  the  digital  processor  are  stored  in  a  latch  buffer  and  are  coming 
in  through  the  parallel  interface.  From  there  the  signals  are  sent  to  the  digital  processor  via  the  digital 
processor  bus.  The  output  discretes  are  sent  via  the  digital  processor  bus  to  the  output  latch  buffer. 
From  the  output  latch  buffer  the  discrete  signals  are  transferred  in  the  parallel  mode  to  the  discrete  hold 
circuits.  The  hold  circuits  are  the  refresher  type  that  require  periodic  updating  for  the  discretes  to 
stay  in  the  ON  state.  This  assures  that  if  the  digital  processor  stops  functioning  the  discrete  signals 
will  go  towards  the  OFF  state  typically  within  two  to  four  samples.  The  wrap-around  loop  uses  the  serial 
interface  of  the  shift  registers.  The  output  latch  buffers  are  wrapped  around  to  the  input  latch  buffers 
and  the  testing  is  similar  to  the  analog  to  digital  converter  test.  The  digital  processor  uses  the  test  pat¬ 
terns  previously  discussed  and  feeds  the  data  to  the  output  latch  buffer  in  the  parallel  manner.  From 
there  the  data  is  transferred  to  the  input  latch  buffers  using  the  serial  link  between  the  input  and  out¬ 
put  latch  buffers.  The  digital  processor  receives  the  data  from  the  input  latch  buffer  and  compares  them 
for  bit  identical  patterns.  Using  all  test  patterns,  one  pattern  at  a  time,  and  obtaining  good  results 
assures  normal  operation  of  the  discrete  interface.  The  experience  of  the  authors  is  that  the  discrete 
interface  is  a  much  more  cumbersome  and  difficult  task  for  design,  test,  and  validation  than  the  analog 
signal  interface. 

The  cross  channel  data  link  interface  ia  best  described  with  reference  to  Figure  3.3.  This  inter¬ 
face  is  the  communication  link  between  the  different  digital  processors  of  the  engine  control  system.  This 
test  uses  again  the  previously  discussed  test  patterns  where  each  of  the  digital  processors  sends  the  test 
patterns  to  the  other  processors,  all  working  time  synchronous.  The  digital  processors  start  their  com¬ 
putational  cycle,  which  typically  varies  from  10  to  20  milliseconds,  at  the  same  instant.  Since  all  pro¬ 
cessors  start  their  task  of  continuous  BIT  simultaneously  and  all  processors  know  what  data  is  to  be 
received  since  they  are  also  transmitting  the  same  data,  each  processor  can  check  the  data  received  from 
the  other  processors  and  verify  normal  operations.  Receiving  all  test  patterns  from  the  other  processors 
in  the  bit  Identical  manner  assures  normal  operation  of  the  cross  channel  data  Hnk. 

Many  of  the  digital  processor  interfaces  to  the  outside  world  have  their  own  dedicated  RAM  memory. 
This  RAM  memory  requires  a  separate  test,  identical  to  the  test  for  the  previously  discussed  processor 
RAM  memory,  which  was  described  at  the  beginning  of  this  section. 
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The  testing  of  the  MIL-STD-1553  bus  system  is  specified  as  part  of  MIL- STD -1553.  The  only 
recommendations  that  the  authors  have  is  that  if  the  dual  bus  which  is  specified  in  the  M1L-STD  is  used, 
the  system  should  alternate  between  the  A  bus  and  the  B  bus.  By  using  the  buses  in  an  alternate 
manner,  a  failed  bus  is  detected  at  the  time  the  first  failure  occurs  and  a  failed  system  is  not  carried 
along  without  knowing  that  a  failure  has  occurred.  Using  the  same  bus  until  a  failure  occurs  can  result 
in  having  had  a  failure  in  the  bus  system  not  being  used  and  when  trying  to  use  the  second  part  finding 
that  the  system  had  previously  failed. 

3.2  Typical  Redundancy  Management  Concepts  for  Signals  Interfacing  With  A  Quadruplex  Digital  Control 
System 

3.2.1  Input  Sensor  Management 

This  section  discusses  the  failure  detection  of  redundant  input  sensor  signals.  In  case  of  engine 
controls,  typical  input  signals  are  pressure  signals,  RPM  signals,  and  temperature  signals.  Pilot  command 
signals  and  actuntor  position  signals  also  fall  into  this  category.  The  testing  is  best  described  with  ref¬ 
erence  to  Figure  3.4  which  shows  the  data  flow  for  the  testing.  One  capability  found  in  the  digital  sys¬ 
tems  that  is  not  available  in  analog  systems  is  the  use  of  separate  criteria  for  selecting  the  signals  to  be 
used  for  computation  and  detecting  if  a  signal  is  failed.  Assuming  the  quadruplex  channel  system,  shown 
in  Figure  3.4,  each  of  the  four  processors  receives  all  four  sensor  signals,  one  from  its  own  A  to  D  con¬ 
verter  and  the  other  three  from  the  cross  channel  data  link.  The  typical  procedure  is  to  perform  a  rea¬ 
sonableness  test  which  also  produces  some  filtering  on  the  data. 

This  filtering  is  helpful  in  determining  if  the  local  channels  sensor  signal  is  within  normal  operating 
limits  relative  to  the  other  channel  sensor  signals.  The  standard  procedure  is  that  each  processor  can 
only  declare  its  own  signal  failed.  The  criteria  typically  used  is  that  each  sensor  must  be  different  (by 
more  than  the  failure  threshold)  from  all  three  sensor  signals  in  the  same  polarity  direction.  It  is  not 
unusual  to  allow  a  signal  to  indicate  that  it  has  failed  for  several  consecutive  samples  before  the  sensor  is 
officially  declared  failed.  Such  an  occurrence  is  stored  as  failure  indication  data.  That  data  should  be 
displayed  at  the  poBt  flight  system  check  for  maintenance  action.  If  the  signal  is  not  within  tolerance,  it 
is  not  used  as  part  of  the  signal  selection  algorithm  that  determines  the  sensor  signal  value  to  be  used  in 
the  control  computations. 

The  selected  signal  for  computation  is  typically  the  average  of  the  middle  values  if  all  four  signals 
of  the  previous  computation  have  been  declared  good;  it  is  the  middle  value  if  there  are  three  good 
signals;  and  it  is  the  lower,  nonzero  value,  if  there  are  only  two  good  signals  remaining.  The  lower 
nonzero  value  is  chosen  to  prevent  hardover  signals  and  signals  failed  to  zero  from  being  selected. 

Discrete  signal  failures  are  detected  through  a  time  relationship.  Each  digital  processor  receives  all 
four  signals  (either  through  its  own  interface  of  through  the  cross  channel  data  links)  and  determines  the 
good  /failed  status  of  each  signal  and  the  switching  action  that  should  take  place  in  the  central  system. 

The  closing  or  opening  action  of  switch  contacts  on  a  multipole  switch  typically  do  not  occur  simul¬ 
taneously.  Consequently  it  is  possible  that  there  is  a  substantial  time  difference  between  the  status 
change  of  the  first  set  of  contacts  and  the  last  set  of  contacts  on  a  multipole  switch  in  response  to  a 
typical  command.  The  only  exception  is  switches  incorporating  a  mechanical  overcenter  device  that  makes 
the  switch  assembly  into  a  bistable  device.  The  bistable  switch  assembly  is  recommended  for  use  with 
redundant  digital  systems. 

Assuming  that  a  switching  action  is  initiated  by  some  component  within  the  engine  control  system, 
actual  switching  in  the  processor  occurs  after  a  majority  of  the  good  signals  have  changed  state.  For 
example,  if  there  are  four  good  signals  and  three  of  the  four  signals  have  changed  state,  the  processor 
assumes  that  the  switching  command  is  correct  and  will  perform  the  switching  Indicated.  Discrete  signals 
have  a  designated  time  limit,  a  typical  number  is  150  milliseconds,  to  complete  switching.  If  the  fourth 
signal  in  the  previous  example  completes  switching  prior  to  the  switching  time  limit  expiring,  no  failure  is 
declared.  If  the  fourth  signal  does  not  switch  prior  to  the  time  limit  expiring,  the  processor  will  declare 
the  fourth  signal  failed.  The  same  procedure  is  used  if  there  are  only  three  or  two  good  signals. 

One  should  note  that  in  discrete  signals  it  is  quite  possible  to  have  two  simultaneous  failures, 
making  it  impossible  for  the  processor  to  isolate  the  failed  signals.  It  is  therefore  important  to  define  for 
each  type  of  discrete  signal  the  preferred  state  to  which  the  processor  will  revert  the  system  if  it  is  no 
longer  possible  to  determine  what  the  discrete  status  is.  In  some  cases,  the  preferred  state  is  a  condi¬ 
tional  situation  depending  on  other  variables  available. 

3.2.2  Actuator  Management 

The  remaining  failure  detection  concept  is  the  actuation  system  failure  Identification.  This  is  the 
most  difficult  concept  and  also  has  the  most  conceptual  variation.  The  authors’  preferred  concept  la  the 
electro-hydraulic  servo  valve  with  multiple  coils.  This  concept  is  shown  in  Figure  3.5.  The  advantage  of 
the  multiple  coil  concept  is  that  it  allows  interface  of  multiple  electrical  channels  to  one  actuator  without 
violating  the  electrical  isolation  requirements.  Most  engine  control  systems  use  the  single-fluid  actuator, 
which  is  substantially  simpler  to  control  and  monitor  than  the  dual  fluid  system  typically  used  in  flight 
controls.  Since  position  accuracies  of  ±2  percent  are  acceptable  for  engine  control  systems,  the  electrical 
command,  mechanical  feedback  concept  is  recommended.  This,  in  turn,  will  lead  to  the  simplified  in-line 
monitoring  concept  shown  in  Figure  3.5,  The  in-line  monitoring  concept  duplicates  the  drive  circuit  used 
on  the  primary  actuator  for  monitoring  and  compares  the  drive  currents  from  the  model  drive  circuit  to 
the  actual  circuit.  Failure  identification  of  each  circuit  is  nearly  instantaneous  and  thereby  prevents 
large  failure  transients.  This  actuation  system  is  three-fail  operate  electrically,  but  since  there  is  only 
one  E1IV  and  only  one  fluid  system,  there  is  no  fail  operational  capability  in  the  fluidic  portion. 
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There  is  an  additional  method  of  failure  detection  available  for  engine  control  systems.  This  con¬ 
cept  is  based  on  real  time  modeling  of  the  thermodynamic  engine  In  the  onboard  digital  processor.  This 
concept  is  shown  in  Figure  3.6.  Such  a  real  time  model  was  developed  by  General  Electric  and  demon¬ 
strated  as  part  of  the  FADEC  program.  The  results  are  published  in  a  SAE  paper  (Reference  1).  This 
paper  describes  a  real  time  modeling  concept  of  the  thermodynamic  engine  which  provides  all  sensor 
signals  of  the  engine.  This  model  can  be  carried  in  the  digital  processor  controlling  the  engine  and  the 
sensor  outputs  from  the  model  can  be  used  to  control  the  engine.  By  using  Kalman  filtering  techniques 
to  make  the  engine  and  sensor  signals  track  together,  one  can  determine  failures  of  the  sensors  and  con¬ 
tinue  to  operate  the  engine  in  the  presence  of  sensor  failures,  even  if  there  is  only  one  digital  processor 
in  the  engine  control  system. 

3.3  Computing  Probability  of  Engine  Operation 

There  are  several  possible  approaches  to  determine  the  probability  of  operation  of  an  engine  control 
system.  A  typical  approach  is  to  determine  the  for  each  component  and  the  probability  of  operation  is 
the  sum  of  all  the  individual  's.  This  approach  is  not  suitable  for  redundant  fly-by-wire  type  control 
systems.  This  is  mostly  due  to  the  fact  that  there  is  a  high  dependency  and  interrelationship  in 
redundant  control  systems  that  defeats  the  summation  technique. 

For  the  probability  of  operation  analysis  of  redundant  electronic  control  systems  the  probability 
block  diagram  modeling  approach  is  recommended.  This  requires  the  construction  of  a  block  diagram  rep¬ 
resenting  the  total  control  system.  The  total  control  system  consists  of  the  electrical  power  circuits,  the 
fluidic  power  systems,  the  electronic  system  segments,  the  wiring  of  the  control  system,  the  sensors  and 
the  actuators  of  the  control  system.  The  basis  for  such  a  diagram  is  shown  in  Figure  3.7  for  a  gener¬ 
alized  control  system.  The  solid  lines  represent  a  single  digital  processor  system.  Adding  the  dotted 
lines  results  in  a  dual  digital  channel  processor  system.  The  fluidic  portions  are  single  channel.  Each  of 
the  components  or  blocks  has  its  own  MTBF  and  the  probability  of  failure  of  that  block  is  1/MTBF. 

By  adding  the  sensors,  electrical  fuel  control  circuits  and  electrical  actuator  control  circuits  to  the 
output  states  defined  by  Figure  3.7  a  probability  of  operation  flow  diagram  can  be  constructed,  as  shown 
by  Figure  3-8.  The  control  system  is  operational  if  a  continuous  path  exists  from  the  left  side  of  the 
flow  diagram  to  the  right  side  of  the  flow  diagram.  The  individual  branches  of  the  flow  diagram  are  con¬ 
nected  by  AND  gates  and  OR  gates. 

Figure  3-8  illustrates  probability  of  operation  for  a  nonredundant  control  system.  Being  single 
channel,  the  system  has  poor  probability  of  operation  with  the  expected  number  of  failures  per  million 
flight  hours  determined  by  adding  the  probability  of  failure  (or  )  of  each  block. 

Figure  3.9  represents  a  dual  digital  channel  engine  control  system  with  the  previously  used  single 
channel  fluid  systems.  The  outputs  of  Figure  3.7  are  used  as  inputs  to  Figure  3.9  as  in  the  previous 
example.  The  sensors,  electronic  fuel  control  circuits  and  electronic  actuator  control  circuits  are  also 
dualized.  The  multiple  EHV  coil  interface  approach,  previously  discussed,  was  assumed.  The  resulting 
block  diagram,  shown  in  Figure  3.9,  is  substantially  more  complex  than  the  previously  shown  single 
channel  system.  By  inspection  one  can  determine  that  the  resulting  control  system  can  operate  after  the 
following  failures: 

1.  One  digital  processor,  or 

2.  One  fuel  control  channel  failure  plus  one  Vane  guide  actuator  channel  failure  plus  one  nozzle 
actuator  channel  failure,  or 

3.  One  electrical  power  system  failure.  All  other  failures  lead  to  loss  of  engine  control. 

An  additional  level  of  redundancy  is  shown  in  Figure  3.10.  In  this  configuration  use  is  made  of  the 
Cross  Channel  Data  Link  (CCDL)  that  allows  data  exchange  between  the  digital  processors.  The  outputs 
of  Figure  3.7  again  provide  the  inputB  to  Figure  3.10.  Even  though  the  hardware  complexity  increased 
very  little,  the  complexity  of  the  block  diagram  in  Figure  3.10  increased  substantially  over  the  previous 
two  figures.  The  addition  of  the  CCDL  allows  the  control  system  to  operate  the  actuation  control  circuits 
of  channel  1  with  the  sensors  of  channel  2  and  visa  versa.  In  addition,  the  exchange  of  sensor  signals 
allows  better  testing  and  failure  isolation. 

The  systems  shown  in  Figures  3.9  and  3.10  can  no  longer  be  analyzed  by  summing  up  the  probabil¬ 
ity  of  failure  of  the  individual  blocks.  In  order  to  obtain  the  probability  of  the  engine  control  system 
failure ,  one  must  write  the  probability  equations  of  the  block  diagram  and  compute  the  probability  of  loss 
of  engine  control  based  on  mission  duration.  The  probability  of  aircraft  loss  increases  exponentially  with 
mission  duration. 

There  are  additional  implications  to  the  block  diagrams  in  Figures  3.9  and  3.10.  Each  of  the  OR 
gates  indicates  redundant  systems  with  either  system  having  the  capability  of  controlling  the  engine.  By 
computing  the  probability  of  operation  in  the  manner  indicated,  one  makes  implicitly  the  assumption  that 
all  failures  are  detected  and  the  control  system  is  reconfigured  In  a  safe  manner.  In  other  words,  a 
failure  can  not  cause  critical  damage  to  the  engine  prior  to  system  reconfiguration  and  the  reconfiguration 
circuits  can  never  fall.  This  would  imply  a  coverage  of  1  which  is  not  possible.  However,  using  good 
design  practices  and  a  good  OBIT  and  1B1T  concept,  coverages  above  0.9S  are  possible  and  are  also 
satisfactory. 

By  using  the  recommended  analysis  approach,  one  can  analyse  systems  of  any  complexity.  Being 
able  to  analyse  systems  allows  one  to  trade  off  different  system  redundancies  and  redundancy  management 
concepts.  Baaed  on  work  performed  in  flight  controls,  the  authors  believe  that  It  is  possible  to  meet  the 
"proposed  requirements  definition  for  redundancy  management"  postulated  In  Section  3.4. 
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3.4  Requirements  Definition  for  Redundancy  Management 


The  redundancy  and  fail-operational  capability  requirements  of  a  control  system  must  be  developed 
with  guidance  from  probability  analysis.  The  basic  design  requirements  for  such  an  approach  is  to  define 
the  criteria  for: 

1.  Allowable  Probability  of  plant  shutdown  due  to  control  system  failure. 

2.  Allowable  Probability  of  Mission  Abort. 

3.  Design  Mission  Duration. 

4.  Probability  of  damage  to  the  plant  being  controlled  due  to  control  system  failures. 

Using  again  Flight  Control  Technology  as  reference,  the  probability  of  loss  of  aircraft  due  to  flight 
control  system  failures  of  a  tactical  fighter  is  typically  less  than  10“7  and  the  probability  of  mission  abort 
due  to  flight  control  system  failure  must  be  less  than  10“®.  Mechanical  flight  controls  cannot  be  built  to 
meet  these  criteria,  but  an  electronic  flight  control  system,  designed  to  have  the  necessary  redundancy 
and  fail-operational  capability,  can  meet  the  specified  criteria. 

The  criteria  for  engine  control  system  loss  can  be  specified  in  the  same  manner  as  for  flight  con¬ 
trols.  There  might  be  a  difference  in  loss  of  control  criteria  for  single  and  multiple  engine  aircraft.  The 
critical  case  is  the  single  engine  airplane  and  the  criteria  development  in  this  paper  will  use  a  single  en¬ 
gine  tactical  aircraft  example.  Considering  that  loss  of  engine  control  typically  causes  loss  of  the  air¬ 
craft,  the  allowable  probability  of  engine  control  system  failure  is  less  than  10-7. 

The  second  item  that  must  be  specified  is  the  probability  of  mission  abort  due  to  engine  control 
system  failure.  The  probability  of  one  mission  abort  per  10+®  missions  used  in  the  flight  control  system 
is  considered  applicable  and  will  be  used  here. 


The  third  item  is  the  mission  duration  time.  According  to  M1L-F-9490D,  the  applicable  flight  control 
system  specification,  the  design  mission  is  typically  the  longest  mission  that  does  not  require  mid-air  re¬ 
fueling.  The  longest  mission  for  a  tactical  fighter  is  the  ferry  mission  and  the  specified  mission  time  for 
this  design  is  2  hours. 

Fourth,  the  allowable  probability  of  damage  to  the  engine  due  to  the  control  system  failures  must  be 
considered.  Due  to  the  high  cost  of  engine  repair,  no  failure  within  the  engine  control  system  is  allowed 
to  result  in  damage  to  the  engine.  The  probability  specified  for  engine  damage  must  therefore  be  less 
than  10“7  which  is  the  probability  of  total  loss  of  engine  control.  The  specified  probability  is  10'®. 


The  design  requirements  specified  so  far  are: 

_7 

1.  Allowable  probability  of  engine  failure  due  to  engine  control  system  failures  is  less  than  10  or 
one  failure  in  107  flight  hours. 


2. 


Allowable  probability  of  mission  abort  due  to  engine  control  system  failure  is  less  than  10 
mission.  This  can  also  be  expressed  as  one  mission  abort  every  10®  missions. 


per 


3.  The  design  mission  duration  is  2  hours. 

-8 

4.  Allowable  probability  of  engine  damage  due  to  engine  control  system  failure  is  less  than  10  . 

Based  on  these  requirements  and  proper  use  of  probability  analysis,  the  redundancy  management 
portion  of  the  engine  control  system  can  be  specified. 


Missions  time  for  probability  operations  are  not  necessarily  the  same  functionly  as  mission  time 
which  is  from  take-off  to  landing.  Mission  time  for  probability  computations  is  the  time  between  complete 
system  validations.  This  includes  all  functions  rarely  used,  such  as  limits,  reconfiguration  circuits, 
failure  detection  circuits,  sensors,  actuators,  etc.  To  make  this  definition  mathematically  complete,  a 
coverage  greater  than  .95  for  all  systems  and  component  tests  is  specified  as  an  acceptable  system 
validation,  it  can  be  safely  stated  that  a  manual  system  check  to  95  percent  coverage  is  not  possible. 
Such  a  tost  is  typically  automated  as  a  combination  of  continuous  BIT  and  prefUght/poatflight  BIT  with 
some  manual  tasks  such  as  moving  controls  and  switches  done  by  the  pilot.  Such  a  teat  must  be  con¬ 
sidered  from  the  Initial  design  to  meet  the  specified  requirements.  One  should  note  that  the  probability 
mission  time  approaches  equipment  installed  time  as  coverage  approaches  lero. 


4.  CONTROL  SY8TEM  INTEGRATION.  DEVELOPMENT  TESTING,  AND  VALIDATION  TESTING 

A  complex  digital  control  system ,  of  ths  nature  discussed  In  this  paper,  must  be  Integrated  and 
validated  In  a  closed  loop  environment.  A  closed  loop  environment  means,  in  this  case,  that  the 
thermodynamic  engine  characteristics  are  being  modeled  by  a  digital  processor  and  that  the  input  vari¬ 
ables  (auch  as  flow,  fan  position ,  vane  guide  positions ,  and  exhaust  nosale  area)  are  used  as  input  to 
the  thermodynamic  engine  model.  The  outputs  of  the  thermodynamic  engine  model  are  the  sensor  tnputs 
to  the  engine  control  system.  Having  a  complete  engine  control  system,  constating  of  tha  actual  hardware 
and  software ,  not  a  simulation  of  it,  integrated  with  the  thermodynamic  loop  closure  aa  previously 
described,  allows  one  to  simulate  engine  operation  of  tha  total  engine  tn  its  final  configuration.  In  tha 
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design  of  the  control  system  (prior  to  specification  release  for  the  individual  LRUs),  one  must  make  pro¬ 
visions  so  that  all  inputs  to  the  thermodynamic  engine  model  are  available  as  electrical  signals,  and  to 
make  provisions  so  that  all  inputs  from  the  thermodynamic  engine  model  to  the  engine  control  system  can 
be  entered  in  parallel  with  the  actual  sensors.  An  alternate  to  this  approach  is  a  sensor  input  simulation 
so  that  the  output  of  the  actual  sensor  can  be  used  as  input  to  the  engine  control  system. 

Testing  to  be  performed  on  such  engine  controls  teat  stands  oonsists  of  the  following: 

1.  Integration  of  all  control  system  components  and  their  functional  evaluation. 

2.  Engine  controllability  evaluation  over  the  flight  envelope.  (It  should  be  pointed  out  that  the 
controls  test  bench  testing  is  rather  inexpensive  and  that  time  can  be  apent  cost  effectively 
verifying  all  aspects  of  engine  operations.) 

3.  Validation  of  the  failure  modes  and  effects  analysis  and  the  single  point  failure  analysis. 

4.  Dynamic  thrust  response  evaluation  of  the  simulated  engine  and  engine  control  system  com¬ 
bination  . 

By  performing  the  testing  in  a  rather  rigorous  and  extensive  manner  many  problems  typically  dis¬ 
covered  in  the  flight  test  program  can  be  discovered  on  the  engine  test  stand.  The  prerequisite  for  such 
a  statement  is  that  the  thermodynamic  engine  model,  which  is  contained  as  mathematical  equation  in  a 
digital  processor,  has  the  necessary  fidelity.  Such  models  can  be  formed  as  is  Indicated  in  Reference  1. 

The  authors'  design  for  an  engine  controls  test  stand  is  shown  as  block  diagram  in  Figure  4.1. 
Assuming  that  the  engine  test  stand  is  used  by  the  engine  designer,  it  must  have  the  capability  of  sim¬ 
ulating  typical  aircraft  acceleration  and  deceleration  profiles,  typical  climb  and  descent  profiles,  and  oper¬ 
ation  at  any  constant  Mach  and  altitude  point.  At  any  of  these  paints  in  the  flight  envelope,  the  engine 
must  be  able  to  accel/decel,  simulate  air  starts  or  perform  any  other  required  functions. 

It  is  the  authors'  opinion  that  all  testing  to  be  done  in  the  engine  test  cell  should  also  be  done 
first  on  the  engine  controls  test  stand.  This  assures  that  the  time  spent  in  the  test  cell  is  used  for 
maximum  benefit  since  all  test  procedures  have  been  previously  validated.  One  of  the  experiences  fre¬ 
quently  encountered  is  that  the  first  set  of  test  instructions  shows  definite  weaknesses  and  have  to  be 
corrected  prior  to  use  on  the  actual  aircraft. 

Another  benefit  of  the  controls  test  stand  is  the  total  validation  of  the  continuous  and  initiated 
built-in  tests.  It  is  extremely  difficult  to  finalise  such  concepts  on  the  actual  engine.  The  capability  of 
stopping  the  simulation  at  any  time,  investigating  the  individual  conditions  existing  at  that  point,  and 
continuing  on  after  all  the  errors  have  been  corrected  and  unexpected  indications  are  understood,  is  of 
immense  value.  This  type  of  testing  is  not  only  of  value  at  the  initial  development  of  the  engine  control 
system,  but  also  during  engine  tests  and  flight  test  programs.  One  can  simulate  engine  abnormalities  and 
thereby  gain  a  better  Insight  into  problems  occurring  in  testing  that  cannot  be  analysed  in  such  detail  in 
an  engine  test  cell  or  in  a  flight  test  program. 

The  authors  also  envision  use  of  engine  control  test  stands  by  the  airframe  manufacturer.  Such  a 
test  stand  will  probably  become  part  of  the  control  system  development  test  stand.  If  a  complex 
fly-by-wire  control  system  or  integrated  flight  and  propulsion  controls  test  Btand  is  used  on  a  particular 
airplane,  the  Interaction  between  engine,  electrical  power  system,  hydraulic  power  system  and  the  flight 
control  system  can  be  validated.  By  having  all  theae  subsystems  functioning  together  on  the  same 
controls  test  stand,  interactions  of  these  subsystems  can  be  analysed  if  there  are  problem  areas; 
corrections  can  be  found  and  implemented. 

An  additional  area  of  concern  for  the  airframe  contractor  is  the  engine  inlet  and  the  airframe  inter¬ 
action.  By  modeling  the  inlet  in  the  proper  fashion  and  by  using  the  controls  test  stand  as  a  flying  sim¬ 
ulator,  the  excursions  of  alpha  and  beta  (which  are  typically  critical  to  the  inlet  and  airframe  integration) 
can  be  investigated.  In  considering  such  an  investigation  one  muBt  realise  that  the  maximum  alpha  and 
beta  excursion  which  are  of  interest  typically  occur  during  failures  in  the  control  system  or  are  due  to 
gust  disturbances  on  the  aircraft.  By  obtaining  the  alpha  and  beta  excursions  due  to  control  system  fail¬ 
ures  and  simultaneously  simulating  the  effect  on  engine  performance,  one  has  the  capability  to  verify  if 
there  is  a  problem  and  teat  possible  solutions  to  the  problem.  The  same  is  true  for  disturbances  due  to 
gusts. 

5.  CONCLUSION 

i 

This  paper  haa  presented  the  control  system  design  technique  used  by  the  authors  in  the  develop¬ 
ment  of  electronic  flight  controls  translated  to  the  development  of  engine  controls.  Valuable  lessons  have 
been  learned  in  the  past  decade  in  the  development  of  fault  tolerant,  flight  critical  flight  controls. 
Through  this  experience  a  process  of  linear /nonlinear  analysis,  simulation,  and  hardware  Integration  test¬ 
ing  haa  developed.  Structuring  the  control  system  design,  documentation  and  testing  as  recommended  in 
this  paper  offers  the  hope  of  leading  to  control  systems  that  function  as  desired,  have  no  hidden  prob¬ 
lems,  and  can  be  developed  in  a  coat-effective  manner. 
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1.  TURBINE  INLET  TEMPERATURE  LIMIT 

2.  LOW  PRESSURE  COMPRESSOR/TURBINE  RPM  LOWER  LIMIT 

3.  LOW  PRESSURE  COMPRESSOR/TURBINE  RPM  UPPER  LIMIT 

4.  LOW  PRESSURE  COMPRESSOR  STALL  LIMIT 

5.  LOW  PRESSURE  COMPRESSOR  OUTPUT  PRESSURE  UPPER  LIMIT 
8.  LOW  PRESSURE  COMPRESSOR  OUTPUT  PRESSURE  LOWER  LIMIT 
7.  ENGINE  BYPASS  RATIO  (UPPER)  LIMIT 

B.  ENGINE  BYPASS  RATIO  (LOWER)  LIMIT 

I  HIGH  PRESSURE  COMPRESSOR/TURBINE  RPM  LOWER  LIMIT 
IB.  HIGH  PRESSURE  COMPRESSOR/TURBINE  RPM  UPPER  LIMIT 

II.  HIGH  PRESSURE  COMPRESSURE  OUTPUT  PRESSURE  UPPER  LIMIT 
II.  HIGH  PRESSURE  COMPRESSURE  OUTPUT  PRESSURE  LOWER  LIMIT 
11  HIGH  PRESSURE  COMPRESSURE  OUTPUT  TEMPERATURE  UPPER  LIMIT 

14.  HIGH  PRESSURE  COMPRESSURE  OUTPUT  TEMPERATURE  LOWER  LIMIT 

II  RICH  FUEL  FLOW  LIMIT  FOR  MAIN  COMBUSTOR  IGNITION 

15.  RICH  FUEL  FLOW  LIMIT  FOR  MAIN  COMBUSTOR  OPERATION 
17.  LEAN  FUEL  FLOW  LIMIT  FOR  MAIN  COMBUSTOR  IGNITION 
IB.  LEAN  FUEL  FLOW  LNBIT  FOR  MAIN  COMBUSTOR  OPERATION 
IB.  RICH  FUEL  FLOW  LIMIT  FOR  AS  PILOT  LIGHT  IGNITION 


20.  RICH  FUEL  FLOW  LIMIT  FOR  AB  PILOT  LIGHT  OPERATION 

21.  LEAN  FUEL  FLOW  LIMIT  FOR  AB  PILOT  LIGHT  IGNITION 

22.  LEAN  FUEL  FLOW  LIMIT  FOR  AB  PILOT  LIGHT  OPERATION 

23.  RICH  FUEL  FLOW  LIMIT  FOR  At  I6NITION 

24.  RICH  FUEL  FLOW  LIMIT  FOR  AB  OPERATION 

25.  LEAN  FUEL  FLOW  LIMIT  FOR  AB  IGNITION 

26.  LEAN  FUEL  FLOW  LIMIT  FOR  AB  OPERATION 

27.  MAX  MAIN  BURNER  TEMPERATURE  LIMIT 
21.  MIN  MAIN  BURNER  TEMPERATURE  LIMIT 

28.  MAX  MAIN  BURNER  PRESSURE  LIMIT 

30.  MIN  MAIN  BURNER  PRESSURE  LIMIT 

31.  MAX  AB  TEMPERATURE  LIMIT 

32.  MIN  AB  TEMPERATURE  LIMIT 

33.  MIN  FAN  VANE  GUIDE  ACTUATOR  ELECTRICAL  TRAVEL  LIMIT 

34.  MAX  FAN  VANE  6UI0E  ACTUATOR  ELECTRICAL  TRAVEL  LIMIT 

35.  MIN  HPC  VANE  ACTUATOR  MECHANICAL  COMMAND  LIMIT 
3S.  MAX  HPC  VANE  ACTUATOR  MECHANICAL  COMMAND  LIMIT 
37.  MIN  VEN  ACTUATOR  ELECTRICAL  TRAVEL  LIMIT 

3S.  MAX  VEN  ACTUATOR  ELECTRICAL  TRAVEL  LIMIT 


TABLE  2.1  ENGINE  CONTROL  SYSTEM  LIMITS 
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FIGURE  31  BLOCK  DIAGRAM  FOR  ANALOG  TO  DIGITAL  AND  DIGITAL  TO 
ANALOG  CONVERTER  SUBSYSTEM 
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VALVE  DRIVE  AND  COMPARATOR  DISCONNECT  ELECTRONICS 
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FIGURE  3.5,  POSSIBLE  ACTUATION  SYSTEM  CONCEPT 


FIGURE  3.6.  USE  OF  ONBOARD  COMPUTER  MODEL  FOR  FAILURE  DETECTION  AND  CONTROL 


FIGURE  3-8.  PROBABILITY  OF  OPERATION  FLOW  GRAPH  FOR  SINGLE  CHANNEL  SYSTEM 
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RESUME 

La  regulation  numdrique  ouvre  la  porte  a  une  plus  grande  integration 
par  le  biais  de  nouveaux  dialogues  avec  le  pilote  et  les  autres  systSme 
pour  assurer  de  nouvelles  fonctions,  soit  pour  pe rf ectionoer  les  servic 
domaines  vises  couvrent  de  meilleures  performances,  une  optimisation  pi 
plus  grande  facility  de  pilotage.  Pour  cela,  il  faut  faire  dialoguer  pi 
Plusieurs  structures  le  permettent.  Une  mdthode  de  choix  de  structure  e 
conserver  A  cheque  systSme  important  son  autonomie  en  cas  de  difficult^ 
ben£ficier  des  avantages  de  1  *  integration .  Les  fonctions  soot  analysdes 
en  pyramide  de  faqon  a  respecter  une  non  propagation  de  panne.  L'object 
ver  au  systAme  integre  une  organisation  comprehensible  et  maitrisable. 
non  optimale,  donne  la  priorite  a  la  securite  d ' une  part,  et  a  un  parta 
bilites  sans  ambiguite  d ' autre  part. 


du  moteur  a  l'avion 
avions,  soit 
es  actue Is  .  Les 
us  globale  et  une 
usieurs  systSmes. 
st  proposde  pour 
et  pour  toutefois 
puis  regroupees 
if  est  de  conser- 
Cette  organisation, 
ge  des  responsa- 
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I  -  INTRODUCTION 

Dans  un  moteur  tradi tionne 1 ,  les  fonctions  de  regulation  moteur,  de  surveillance  moteur 
et  de  maintenance,  etaient  bien  distinctes,  reslisees  par  des  equipements  separes.  La  re¬ 
gulation  assure  le  ou  les  debits  carburants  et  la  position  des  organes  mobiles  I  partir 
d* equipements  hydromecaniques ,  regulateurs  et  quelquefois  elect roniques ,  calculateurs  ana- 
logiquea.  La  surveillance  se  limitait  A  des  indications  pilotes  -  PCA  -  Tt7  -  N2,  charge 
au  pilote  d'exercer  la  surveillance  proprement  dite.  La  maintenance  se  faisait  au  sol, 
par  des  moyens  specifiques,  mallettes,  cabines  de  test,  suivant  un  calendrier  programme 
ou  en  fonction  d'anomalier  de  fonct ionnement  telles  qu'elles  pouvaient  dtre  perques  par 
le  pilote. 

Si  les  fonctions  regulation,  surveillance,  maintenance,  etaient  distinctes,  A  fortiori 
les  autres  fonctions  de  l'avion  etaient  rdalisees  quasiment  sans  lien  avec  le  moteur. 

L ' introduction  de  la  regulation  numerique,  rendue  indispensable  par  la  complicati  n  des 
moteurs,  incite  A  repeneer  ces  liens,  soit  parce  que  la  realisation  d'une  nouvelle  fonction 
peut  quelquefois  fttre  limit4e  A  une  simple  modification  de  logiciel  plutdt  qu'A  l'adjonc- 
tion  d'un  nouvel  equipement,  soit  parce  qu'un  dialogue  numdrique  permet  d'envisager  des 
optimisations  globales  qui  auraient  Ate  trop  penalisantes  en  aoalogique. 

A  titre  d'exemple,  une  regulation  numdrique  redondante  implique  un  systAme  sophistiqud 
de  detection  de  panne,  pour  pouvoir  automat iquemen t  et  trAs  rapidement  commuter  d'ur. 
voie  sur  une  autre.  Cet  autotest  regulation  implique  une  surveillance  moteur  qui  peu«.  se 
substituer  A  cells  exerede  par  le  pilote. 

Un  autre  exemple  d' interferences  entre  syatAmes  distinct*  rendus  possibles  par  le  nume¬ 
rique,  pourrait  fitre  une  modification  automatique  des  lois  de  regulation  en  fonction  de 
la  charge  avion. 

II  -  INTEGRATION  MOTEUR  AVION 

II  -  I.  Incirlc  d'une  integration  f onctionnel le 
II  -  1.1.  La  regulation  du  moteur 

La  regulation,  pour  tea  besoins  proprea,  recuellle  sur  le  moteur  un  ensemble  d' infor¬ 
mations  et  les  traite.  II  serait  dommage  que  ces  rdaultats  ne  solent  pea  disponibles  pour 
les  dispositifs  ayant  besoin  d ' in format ions  moteur.  Ceux-ci  sont  d'une  part,  la  aurvell~ 


L 
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lance  en  vol  du  moteur  et  sa  maintenance,  d'autre  part  lea  autres  systfimes  aviona  dont  en 
particulier  la  navigation  et  l'armement. 

Nous  examinerons  ci-dessoua  quelquea  caa  oQ  1'intfirSt  d'une  integration  f onct ionne 1 le 
nous  semble  manifeate. 

La  demande  du  pilote  est  double.  Etre  lib£r£  de  toute  surveillance  moteur  quand  "tout 
va  bien";  il  ae  crle  done  une  nouvelle  fonction  de  surveillance  automatique.  Cette  fonc- 
tion  a'appuie  aur  une  modllisation  temps  riel  embarqule.  I' autre  demande  eat  de  disposer 
d ’ informations  precises  quand  "tout  ne  va  plus  bien"  et  d'un  guide  de  decision  (memento 
eiectronique) .  Ceci  suppose  qu'apr&s  la  detection  d'une  anomalie  il  y  ait  une  localisation 
suf f is amment  precise  de  la  dlfaillance  et,  soit  une  reconfiguration  automatique  avec  infor¬ 
mation  au  pilote  (perte  redondance,  par  exemple),  soit  reconfiguration  manuelle  avec  diag¬ 
nostic  en  clair  au  pilote  (tube  cathodique). 

II  -  1.2. La  maintenance  moteur 

La  maintenance  justifie  d&s  aujourd'hui  sur  des  moteurs  existants  des  equipements  tels 
que  concent rateur  de  donnees  (PMUX) ,  compteurs  de  cycles,  etc .  La  fonction  concentra¬ 

tion  de  donnees  est  en  grande  partie  redondante  avec  celle  de  regulation.  Les  traitements 
de  ces  informations  pour  les  besoins  de  la  maintenance  sont  trSs  variables  suivant  les 
utilisations,  mais  ils  peuvent  tous  utiliser  des  mesures  et  des  calculs  ef fectu^s  par  la 
regulation.  Sans  definir  les  niveaux  de  maintenance  on  peut  distinguer  quatre  niveaux  de 
"demandeurs "  d ' inf ormat ions  qui  visent  3  la  maintenance  du  moteur  : 

-  Diagnostic  en  vol. 

-  Enregis trement  en  vol  (et  depoui 1 1 emen t  au  sol). 

-  Tests  au  sol. 

-  Cestion  centralisee  d'un  pare  de  moteurs. 

A  l'exception  peut  etre  du  premier  niveau,  ces  operations  font  appel  &  des  matlriels 
sp€cifiques  3  la  maintenance  et  different  entre  eux.  Il  est  par  contre  possible  (et  sou- 
haitable)  que  le  moteur  pr€sente  une  interface  commune  3  ces  matlriels.  Les  niveaux  de 
maintenance  £tant  de  plus  en  plus  inf ormatisls  cette  interface  moteur,  elle-meme  nualrique, 
est  un  p£riph£rique  intelligent  des  moyens  de  maintenance. 

II  -  1.3. Au-de 1 3  du  moteur 

Avec  la  navigation  et  l'armement  on  entre  dans  le  domaine  de  1 ' integration  fonc tionne lie 
proprement  dite.  Dlj3  aujourd'hui  deB  calculateurs  comme  1  *  automane t te ,  le  NI  limite, 
l'appauvrisseur  de  tir  font  des  liens  entre  navigation,  tir  et  moteur.  Il  est  bien  Evident 
qu'en  matifere  d ' op t i mi s a t i on  (nombre  de  liaisons  llectriques  ou  Economies  carburant  par 
exemple)  une  meilleure  repartition  doit  etre  etudifie. 

Nous  prendrons  trois  exemples  : 

-  Dans  un  avion  supersonique ,  les  entries  d'air  ont  une  g€om€trie  variable  pour  adapter 
l'lcoulement  et  obtenir  le  meilleur  rendement  d'entrle  d'air.  Il  s'agit  en  general  d'une 
regulation  en  boucle  ouverte  ou  la  position  de  l'eiement  mobile  est  fonction  du  Mach. 
Prendre  en  compte  le  paramStre  entree  d'air  dans  le  probifeme  de  commande  multivariable 
oue  constitue  dlj3  la  regulation  ne  pourrait  qu'ameiiorer  les  performances  generates. 

Cette  approche  pourrait  Stre  generalises  aux  commandes  de  vol  pour  lesquelles  la  poussee 
est  un  param&tre  essentiel  de  la  dynamique  de  vol. 

-  Un  autre  exemple  oil  une  certaine  integration  est  d€j3  un  etat  de  fait,  est  celui  du 
tir.  Devant  le  risque  de  presence  de  gas  chaud  devant  le  moteur,  le  regime  de  celui-ci 
est  automatiquemen t  reduit  par  la  regulation  pour  Iviter  un  risque  de  decrochage.  De 
mime,  d* autres  conditions  de  mauvaise  admission,  comme  une  forte  incidence,  conduisent 

3  une  reduction  preventive  des  gaz.  Une  meilleure  connaissance  des  conditions  rlelles 
d'admission  et  une  action  plus  modules,  c'est-3-dire  moins  brutale,  pourrait  rlduire 
sinon  eiiminer  des  chutes  de  performances  qui  peuvent  etre  asset  gSnantes  pour  le  pilote. 

-  Le  troisifeme  exemple  s'appuie  dans  son  vocabulaire  sur  l'aviation  commerciale. 

Certains  avions  sont  aujourd'hui  Iquipls  d'un  P.M.S.  (Flight  Management  System)  connecte 
3  un  T.C.C.  (Thrust  Control  Computer)  lui-meme  agissant  sur  une  automanette  d'une  part, 
et  sur  la  regulation  moteur  d'autre  part,  par  1 ' intermedia! re  d'un  F.M.C.  (Power  Mana¬ 
gement  Control).  Il  y  a  13  une  multiplicite  de  calculateurs  et  l'on  verra  sans  doute 
rapidement  cette  chains  se  rlduire  d ' au  moins  une  unite,  car  le  moteur  sera  3  mime  d'etre 
directement  connecte  aux  autres  calculateurs. 


Il  -  2, Modes  de  regulation  intlgrls 

La  regulation  a  pour  fonction  de  transformer  une  demande  de  poussle  (manette  des  gaz) 
en  une  poussle  effective.  Pour  cela,  alls  doit  assurer  un  fonctionnement  stabilise  en 
cheque  point  du  domaine  de  vol  le  plus  proche  possible  du  point  de  fonctionnement  thermo- 
dynamique  optimal  du  moteur,  et  elie  doit  assurer  les  transitoiras  les  plus  brillants 
possible  an  respectant  tout  un  ensemble  de  contraintes  :  surchauffe,  survitesse,  dlcro- 

chage  riche,  dicrochage  pauvre,  .  Avec  une  regulation  hydromlcanique  ou  mime  llec- 

tronique  analogique,  il  n'ltait  realists  quo  de  trouver  un  mode  de  regulation  "universal" 
qui  Itait  le  meilleur  compromis .  En  numlrique,  il  est  beaucoup  plus  anvisageable  d'avoir 
plusieurs  modes  de  regulations. 

Certains  modes  sont  des  choix  Internes  de  regulation  du  type  mode  Iconomique,  dont  la 
critlre  sera  da  rlduire  la  consommation  de  potential  moteur  ou  de  carburant,  un  autre 
peut  Itre  le  mode  oppose,  "super  plus",  qui  donnera  un  surcroit  de  performance  au  detriment 


du  potentiel,  Equivalent  aujourd'hui  de  la  surcharge.  II  y  a  Evidemment  Egalement  les 
modes  de  secours  ou  modes  dEgradEs  qui  seront  automatiquement  enclenchEs  en  cas  de  panne. 

II  peut  y  avoir  Egalement  des  modes  rEsultant  d'une  Etude  d ' in t Egrat ion .  II  existe  dEjE 
des  rEgulations  d'approche  ou  rEgulations  de  Vi,  mais  d'autres  modes  peuvent  Etre  envi¬ 
sages.  II  y  a  ceux  qui  correspondent  comme  la  rEgulation  de  Vi,  E  moduler  la  poussEe  pour 
asservir  un  paramEtre  de  vol .  C'est  en  sorte  un  pilote  automatique  du  moteur.  D'autres 
modes  pourraient  rester  E  commande  manuelle,  mais  en  modifiant  I  * interprE t ation  de  cette 
commande .  Par  exemple,  par  une  action  particuliEre  sur  la  manette  on  pourrait  augmenter 
sa  sensibilitE  autour  du  point  de  fonctionnement ,  effet  de  loupe,  pour  faciliter  le  vol 
en  patroui lie . 

Enfin,  certains  modes  de  rEgulation,  y  compris  le  mode  normal,  peuvent  etre  personna- 
lisEs  en  fonction  de  1 ' utilisateur  et  des  missions  de  l'avion. 

II  -  3. Description  d'un  systEme  propulsif  intEgrE 

Nous  avons  jusqu'ici  employE  le  terme  d ' intEgration  f one tionne 1 le .  C'est  pour  l'opposer 
3  intEgration  physique.  11  nous  parait  que  ce  serait  une  erreur  d'envisager  1 ' intEgration 
comme  la  rEunion  de  plusieurs  petits  calculateurs  en  un  seul  gros  me  me  si  1 ' intEgra t ion 
doit  permettre  de  rEduire  le  nombre  de  calculateurs.  Sans  vouloir  redEmontrer  les  risques 
et  les  effets  nEfastes  d'un  seul  calculateur  central  avion,  nous  avons  fait  le  bilan 
analogue  au  niveau  du  moteur.  Refuser  que  les  calculs  se  fassent  au  niveau  du  moteur 
n'empeche  pas  qu'il  serait  nEcessaire  de  conditionner  et  multiplexer  les  mesures  moteurs . 
Le  boitier  qui  en  rEsulterait,  surtout  s’il  doit  etre  muni  d'un  coupleur  numErique  pour 
dialogue  avec  le  calculateur  central,  sera  presque  aussi  important  que  le  calculateur  de 
rEgulation  autonome  et  source  de  beaucoup  plus  de  problEmes,  en  particulier  sur  le  plan 
de  la  sEcuritE. 

II  nous  semble  done,  qu'E  la  base  et  par  moteur,  il  doit  y  avoir  un  dispositif  (calcu¬ 
lateur  numErique)  capable  d'assurer  les  fonctions  : 

-  de  rEgulation 

-  de  dialogue  numErique 

-  de  concentration  de  donnEes. 

Un  certain  nombre  d'autres  fonctions  sont  moins  attachEes  au  moteur  proprement  dit, 
et  couvrent  plutot  1 'ensemble  du  systEme  propulsif,  en  particulier  dans  le  cas  d'un 
multimoteur.  Il  s'agit  d'une  sorte  de  svpervisevr  qui  effectue  des  tEches  de  traitement 
et  sElection  de  consignee  qui  interprEte  des  informations  moteurs  et  les  met  en  forme 
pour  d'autres  systEmes  avion.  C'est  au  minimum  le  coupleur  des  bus  avions .  Cette  fonction 
peut  etre  physiquement  intEgrEe  au  calculateur  de  rEgulation,  mais  alle  peut  aussi  Etre 
distincte;  nous  1 ' appelle rons  alors  :  calculateur  de  gestion  du  systEme  propulsif.  Cette 
structure  (cf.  Figure  1)  permet  de  distinguer  un  dialogue  interne  numErique  entre  cap- 

teurs  numEriques  (le  jour  od  . ),  calculateurs  de  rEgulation,  calculateurs  de  gestion 

du  systEme  propulsif,  liaison  qui  doit  Etre  trEs  sure  mais  qui  peut  Etre  lente  et  le 
dialogue  avion  sur  le  bus  rapide  choisi  par  l'avionneur  et  modifiable  selon  1 ' appl ication . 

III  -  LES  CHOIX  EN  MATIERE  D ’ INTEGRATION 
III  -  l.DiffErents  types  d’ intEgration 

Si  1 ' on  considEre  que  1 ' intEgration  consiste  E  rEunir  plusieurs  fonctions  en  une  fonc¬ 
tion  E  caractEre  plus  gEnEral  ,  il  faut  distinguer  alors  plusieurs  types  d ' int Egrat ion 
selon  1 '  archi  te  c  ture  des  liaisons  physiques  et  cel’,  a  des  liaisons  fonct  ionnelles .  Nous 
citerons  comme  exemples  quelques  uns  des  choix  possibles  sans  chercher  E  les  analyser. 

-  IntEgration  centraiisEe  :  le  maximum  de  fonctions  sont  regroupEes  dans  un  Equipement 
central  (cf.  Figure  2.1). 

-  IntEgration  "anarchique"  :  souvent  rEsulte  d'apports  successis;  las  liaisons  physiques 
et  f onct ionne l les  ne  coincident  pas  forcEment  qt  les  in  te  rac  t  ir*ns  sont  multiples  et  dEs- 
ordonnEes  (cf.  Figure  2.2). 

-  IntEgration  physique  structurEe  mais  intEgration  fonctiwtinelle  anarchique;  les  liaisons 
physiques  sont  rEduites  et  semblent  cohErentes  mais  las  dEpendances  f one t ionne 1 las  sont 
trEs  diffErentes  das  liaisons  physiques  (cf.  Figure  2.3). 

-  IntEgration  physique  et  f onctionne 1 le  structurEe.  Les  liaisons  phyaique  et  f one tionne 1 le 
coincident  at  le  systEme  ast  tel  qu'en  cas  de  perte  da  cartaines  fonctions  les  autres 
fonctions  rastant  capables  de  rendre  un  minimum  de  services. 

La  plupart  des  grands  systEmes  d'un  avion  sont  en  gEnEral  considErEs  comme  suffisamment 
importants  pour  que  la  perte  de  la  fonction  correapondante  soit  difficile  E  admettra. 
Cheque  systEme  peut  alors  Etre  dotE  de  redondances  telles  que  la  probabilitE  da  perte 
de  la  fonction  devienne  nEgligeable.  Il  est  sfduisant  alors  de  reller  ces  systEmes  par 
un  (ou  deux)  bus  numErique  "sQr"  at  da  s'autoriser  alors  n'importe  quel  type  d'Echange 
(intEgration  type.  Figure  2.3).  Cette  dEmarche  est  en  principe  acceptable,  mais  tout 
risque  sur  un  systEme,  Eventual lement  acceptable  pour  ca  systEme,  peut  Itre  inacceptabla 
pour  un  autre.  Une  telle  intEgration  est  done  dangereusa  at  nous  lui  prEfErons  une  archi¬ 
tecture  ou  cheque  sy  time  rfalise  une  intEgration  physique  et  fonctionnelle  structurEe 
(type.  Figure  2.4),  les  systEmes  Etant  reliEs  entre  eux  par  une  liaison  (type  bus)  mais 
n'affectant  qu'une  partis  bien  dEfinie  de  cheque  systEme  interconnectE  (cf.  Figure  J.5). 
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III  -  2.  Lea  liaites  de  1 *  integration  f onctionnal le 

La  separation  des  fonctiona  Atait  la  consAquence  de  deux  objectifa  : 

-  Une  bonne  sAcuritA. 

~  Des  reaponaabi li tAa  techniques  et  indue triel lea  clairea. 

Cea  objectifa  essentials  pourraient  se  voir  reaia  en  cause  par  une  integration  conduite 
aana  precautions. 

L ' integration  eat  en  fait  une  fagoo  d'apporter  dea  services  auppl Aaentaires  aaia  cea 
services  ne  vont  pas  dans  le  sens  de  la  diminution  du  aateriel.  Plus  de  aatAriel  veut  dire 
plus  de  pannes  et  cea  pannes  peuvent  avoir  plus  de  repercussions .  Il  doit  done  y  avoir 
une  analyse  de  la  securitd  pour  qu'en  cas  d'incident  d'un  dispoaitif  conpieaentai re 
(Acran  cathodique,  enregis t reur ,  . )  on  ne  perde  pas  une  fonction  fondaaentale  (regu¬ 

lation  du  aoteur, 

La  necesaite  de  responsabilitea  techniques  et  industrielles  clairea  eat  egaleaent  fon- 
daoentale.  Il  faut  que  ebaque  participant  A  un  prograaae  puiase  s'engager  A  satisfaire 
un  objectif  sans  que  cet  objectif  d€pende  d'un  autre  participant  dont  le  propre  objectif 
depend  lui-meme  du  premier  participant.  Dana  un  tel  partage  cheque  participant  rejettera 
sur  l'autre  le  maximum  de  probl&mes  et  en  cas  de  d6faut  de  fonctionneaent  une  polAmique 
sans  fin  s'engagera.  Un  cas  particulidreoent  sensible  est  celui  d'un  syatAae  pour  lequel 
les  responaables  fonctionnela ,  aat€riels  et  logiciels  ne  aeraient  pas  confondus . 

La  Unite  peut  Stre  de  1 ' integration  fonctionnel le  est  de  limiter  celle-ci  de  fagon  A 
ce  que  le  maftre  d'oeuvre,  qui  est  un  hoane  et  non  pas  une  machine,  puiase  conserver  la 
comprAhensioo  du  f one t ionnemcn t  de  son  systAme,  de  ce  qui  fait  quoi  et  de  qui  fait  quoi. 

Ill  -  3.  Construction  d'un  systAae  intAgrA 

La  suite  et  la  fin  de  cet  article  sera  consacrAe  2  dAcrire  une  mAthode  de  construction 
d'un  systAme  intAgrA  que  nous  appellerona  par  siaplif ication  pyraaide  d ' in t Agrat ion . 

Cette  nAthode  ne  prAtend  pas  dAcouvrir  quoi  que  ce  aoit  de  neuf .  Bile  veut  au  contraire 
faire  conp*-endre  une  approche  qui  n'eat  sans  doute  ou  du  aoina  nous  l'espArons  que  I'ex- 
pression  du  bon  sens. 

Elle  ne  se  veut  pas  non  plua  une  nAthode  d' optimisation  car  au  contraire,  elle  impose 
dee  contraintea  pAnaliaantes  de  fagon  A  respecter  lea  liaites  de  1 ' in t Agra t ion  fonction- 
ne 1 le  te 1 lea  que  dAcrites  ci-deasus. 

Ill  -  4.  Principe  de  la  pyramids  d ' in t Agrat ion 

Le  principe  do  la  pyramids  d * int Agrat ion  consists  A  identifier  i'enseable  des  fonctiona 

A  rAaliser  :  fonctiona  A,  B,  C,  . Z,  puis  A  crier  une  relation  de  dApendance  antre 

ces  fonctiona  du  type,  la  fonction  D  eat  constituAe  de  la  rAunion  dea  fonctiona  A,  B  et 
C.  Cea  fonctiona  doivsnt  ensuite  Atre  asaoci Aes  A  leur  mode  de  rAalisation  ce  qui  conduira 
A  conatater  que  certainea  dea  fonctiona  A,  B  et  C  peuvent  exister  aeulea  (A  et  B  par  exam¬ 
ple)  d'autres  non  (C  par  axemple).  On  dira  alors  que  A  et  B  soot  d'un  niveau  infArieur  A 
C  et  D  et  on  les  reprAaentera  comma  le  montre  la  Figure  3.1. 

L'enaemble  dea  fonctiona  sera  alors  architecturA  en  crAant  le  nombre  de  niveau  nAcea- 
aaire  et  en  a ' interdiaant  qu'una  fonction  d'un  certain  niveau  dApende  de  plua  d'une  fonc¬ 
tion  de  niveau  iaaAdi iteaent  supArieur.  On  obtient  alors  des  architectures  telles  que 
reprAseotAes  dans  la  Figure  3.2. 

La  pyramids  ne  sera  satiafaisaate  que  lorsqu'il  sera  possible  de  dAmontrer  qu'une  panne 
ne  peut  pas  descendrc  la  pyramide,  c'est-A-dire  qua  la  parta  d'une  fonction  ne  peut  pas 
affecter  las  niveaux  infArieurs. 

Dans  cetta  decomposition,  un  aode  dAgradA  est  une  fonction  en  tent  que  tel  (A  ou  B  par 
example),  at  la  complAment  A  ca  aode  dAgradA  (C  par  example)  une  autre  fonction.  Le  aode 
noraal  (D  par  example)  ast  bien  la  rAunion  de  ces  modes. 

t  III  ~  S.  Bxeaple  d ' appl i cat  ion 

La  Figure  4  conatitua  un  example  plua  axpliclte  da  la  pyraaide  d' int Agration .  Bxaainons 
le  caa  da  la  aanatta  das  gas.  La  aanette  das  gas  reprAsente  la  deaande  da  pousaAe.  Celle- 
ci  eat  aujourd ' bui  transaiaa  par  un  systiaa  da  tringlaria  at  da  flexible  lourd  at  source 
de  aoabreuses  difficult!*,  il  aarait  intAraaaaot  da  fairs  plutdt  traaaitar  catta  daaaada 
par  un  bus  avion  at  cala  d'autaot  plua  qu'an  caa  "d* in tAgrat ion"  catta  daaaada  pilots  sera 
corrigAe  par  d'autres  systAaes  avion.  Dans  la  description  da  la  Figure  4,  la  liaison  nuaA- 
rique  (bus  avion)  intarviant  au  niveau  supArieur  da  la  pyraaide  (niveau  4).  L' inf oraation 
"aanatta  digitals"  eat  done  utilisAe  par  la  calculateur  da  gaation  de  la  poumeAe.  Bo  caa 
da  parta  da  catta  information  las  niveaux  infArieurs  na  doivant  pea  Acre  af fact  As.  Laur 
fonction  nAcesaitant  una  inforaation  aanatta,  11  ast  done  obligatoira  qu'una  autra  infor¬ 
mation  Vienna  A  un  niveau  InfArieur  par  example  au  niveau  2,  aanatta  Alectrlqua.  Las 
fonctiona  spAclfiques  A  la  aanatta  digitals  na  peuvent  done  qu' appartanir  au  niveau  4. 

Da  la  aAaa  fagon  il  apparait  una  fonction  au  nlvaau  1  rAgulation  tacbyaA triqua  ainiaua 
qui  doit  Atra  assurAe  ala#  an  caa  da  parta  da  la  aanatta  Alectrlqua,  Il  faut  alors  crAer 
un  troiaiAaa  nlvaau  par  axaapla  un  aanipulateur  A  impulsion*  ou  accepter  un  rAgiae  fixe. 


PYRAMIDE  ELEMENTAIRE 
Figure  3.1 
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III  -  6.  Avantages  et  inconvenient*  de  la  pyraaide 

Coaaenqons  par  lea  inconvenient#  :  La  pyraaide  d *  integration  eat  tr it  contrai gnante , 
car  elle  interdit  le  partage  d'une  alae  fonction  da  niveau  infdrieur  par  pluaieura  fonc- 

tiona  de  niveau  superieur.  De  a£ne,  elle  intcrdit,  alas  si  elle  eat  assortie  d'une  trfet 

bonne  fiabilite,  la  descents  d'une  information.  c'eat  une  demarche  logique  at  non  paa 
probabiliate .  Elle  ne  conduit  ni  vers  une  solution  unique  niv  8  fortiori,  optimal#. 

Par  contre,  elle  ie  prfite  bien  A  une  analyse  de  panne.  Elle  lie  bien  lea  apdc if icat ions 
fonctionnellea  et  la  realisation  mat£rielle.  Elle  peraet  d'aboutir  4  dca  partages  (sous- 
traitances)  sains,  c'eat-4-dire  oQ  le  cooperant  est  responsable  d'un  enaeable  coherent. 

IV  -  CONCLUSION 

L' uti lisation  du  nua€rique  4  bord  de  1* avion  et  en  particulier  dans  le  caa  du  aoteur, 
ouvre  la  porte  4  de  aultiples  communicat ions  qui  Eviteront  certainea  redondances  et  aur- 

tout  qui  permettront  d'offrir  tout  un  ensemble  de  nouveaux  services. 

Le  risque,  et  le  aoteur  y  est  part icul i fcreaent  sensible,  est  qua  pour  fairs  un  peu 
aieux,  on  aboutisse  4  un  syst&ae  si  in te rdi pendant  qu'il  ne  garantisse  plua  la  adcuritd. 
II  nous  semble  done  qu'au  aoins  pour  les  grandes  fonctions  de  l'avion,  il  est  indispen¬ 
sable  de  s'iaposer  qu'en  cas  d'incident,  quitte  4  perdre  dea  services  aupplCaentaire* , 
le  systiae  revienne  autoaat iquement  4  des  fonctions  de  base,  bien  independent**  sans 
possibility  de  propagation  de  panne.  Ceci  veut  dire  que  cheque  syst4ae  est  conqu  et  rea¬ 
lise  comae  un  syst4me  independent  aux  ordres  du  pilote  et  que  1 1  integral ion  fonctionnel le 
se  superpose  pour  augaenter  les  per f omances  et  diainuer  la  charge  de  travail  du  pilots. 
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Three  aspects  of  integration  are  examined  in  which  the  Powerplant  Control  System 
can  be  Integrated  with  the  Aircraft  Systems  to  provide  mutual  benefits.  It  is  shown 
how  the  Powerplant  Control  System  can  be  progressively  integrated  into  the  aircraft 
systems  architecture  by  means  of  a  distributed  computing  system  for  Utility  Systems 
Management.  A  number  of  benefits  can  be  expected  as  a  result  but,  more  Importantly, 
the  Powerplant  Control  System  is  shown  to  be  a  candidate  for  further  improvement  as  a 
result  of  the  integration  and  the  ready  availability  of  off-take  load  related  data. 
Finally  some  of  the  advantages  of  integration  with  Flight  Control  are  discussed, 


INTRODUCTION 

Work  in  the  area  of  Utility  Systems  Management  for  future  aircraft  conducted  at 
British  Aerospace,  Warton  has  led  to  the  adoption  of  a  control  system  architecture 
based  on  Digital  Computing  and  Multiplex  Data  Busses.  The  system  evolved  has  enabled 
the  base  mechanical  functions  of  the  aircraft:  Fuel  System,  Hydraulic  Systems, 
Environmental  Control  and  Secondary  Power  Control,  etc  to  be  successfully  Integrated 
into  the  Avionic  architecture  which  Includes  high  technology  cockpit  displays  and 
controls  essential  for  the  reduction  of  pilot  workload  in  complex  weapon  systems. 

The  system  can  be  shown  to  be  suitable  for  allowing  the  introduction  of  Powerplant 
Control  Systems  into  the  aircraft  in  such  a  way  as  to  retain  the  required  integrity, 
allow  intercommunication  with  other  systems,  and,  Importantly,  to  allow  a  gradual 
Increase  in  technology  from  ourrent  day  analogue  powerplant  control  systems  to  fully 
integrated  digital  systems  with  minimum  disturbance  to  the  overall  aircraft  programme. 

In  addition  the  use  of  sophisticated  digital  systems  allows  more  data  to  be  made 
available  which  can  be  used  to  the  mutual  benefit  of  the  integrated  systems.  Since  the 
aircraft  manufacturer  is  constantly  seeking  improvements  to  the  weapon  system  in  order 
to  make  his  product  more  competitive  integration  is  seen  as  an  Important  tool  to 
achieve  performance  benefits.  Once  Integrated  into  this  structure  the  Powerplant 
Control  System  becomes  a  candidate  for  similar  potential  benefits. 


FUTURE  AIRCRAFT  REQUIREMENTS 

For  future  combat  aircraft  there  is  pressure  to  achieve  better  manoeuvrability 
under  combat  conditions,  and  the  generation  of  projeots  aimed  at  providing  Vertical 
Take  Off  and  Landing  (VTOL)  or  Short  Take  Off  and  Vertical  Landing  (STOVL)  capability 
collectively  provide  additional  challenges  to  the  oontrol  system  designer.  As  well  as 
Improvement  in  combat  handling  there  is  a  need  to  Improve  the  overall  aircraft 
performance  by  using  lighter  materials  to  reduce  airframe  weight  and  by  improving 
engine  performance  over  the  aircraft  flight  envelope. 

In  addition  the  increased  power  load  resulting  from  a  large  avionic  equipment  fit 
and  the  demands  for  high  rate  oontrol  surface  movements  lead  to  a  need  for  high  power 
offtakes  with  transient  demands.  This  can  result  in  problems  with  maintaining  optimum 
continued  engine  operation  throughout  the  flight  envelope. 

Aircraft  which  use  thrust  to  provide  manoeuvre  control,  either  for  take  off  and 
landing  or  for  oombat  manoeuvre  enhancement,  demand  a  degree  of  integration  of  control 
that  has  hitherto  not  been  considered.  In  this  type  of  aircraft  eapeolally  the  pilot 
will  expect  to  achieve  carefree  handling  of  both  aircraft  and  engine  in  all  regimea  of 
flight  with  minimum  workload. 


ASPECTS  OF  INTEGRATION 

Integration  la  evident  in  many  areas  of  the  modern  aircraft  project  proposal, 
particularly  in  Avlonlos,  where  the  Data  Bua  is  utilised  as  a  major  integrating  media 
for  functional  components  of  the  system.  The  data  bus  and  the  emergence  of  readily 
available  digital  eomputlng  elements  has  given  impetus  to  the  integration  of  meohanloal 
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systems  into  the  avionic  structure .  These  mechanical  systems  include  the  aircraft 
Utility  Systems  and  the  Powerplant  Control  System. 

Integration  in  the  area  of  Powerplant  Control  can  take  a  number  of  forms  : 

1.  Integration  of  Powerplant  Control  with  the  Powerplant. 

2.  Integration  of  Powerplant  Control  and  Flight  Control. 

3.  Integration  of  Powerplant  Control  and  Aircraft  Systems. 

Each  aspect  has  its  own  advantages  and  disadvantages  and  in  each  ca3e  the 
mechanism  of  integration  differs. 

In  1.  integration  of  the  Powerplant  Control  system  with  the  Powerplant  itself 
ultimately  consists  of  mounting  the  control  unit  on  the  engine,  incorporating  the 
various  pneumatic  sensors  into  the  package,  and  simplifying  the  Hydromechanieal 
components  by  the  use  of  suitable  algorithmic  techniques.  This  method  can  offer 
significant  cost,  weight  and  complexity  reductions  depending  on  the  degree  of 
integration  that  can  be  tolerated.  However,  with  modern  high  speed  aircraft  the  means 
of  providing  sufficient  cooling  to  obtain  the  requisite  reliability  targets  poses  a 
significant  obstacle  to  immediate  application  (1). 

In  2.  the  integration  of  Flight  Control  and  Powerplant  Control  is  achieved  by 
appropriate  exchange  of  information  between  the  systems.  Information  exchange  can  be 
provided  by  data  bus  links  or  direct  connections  and  further  integration  can  be 
provided  at  the  man-machine  interface  by  suitable  design  of  controls  :  Throttle  Box  and 
Control  Column. 

Integration  of  the  systems  is  seen  as  a  method  of  achieving  benefits  in  the  areas 
of  pilot  workload  reduction  and  weapon  system  performance  improvement. 

In  3.  the  powerplant  control  system  and  the  aircraft  systems  can  be  integrated 
using  the  data  bus  as  a  suitable  medium  for  Information  exchange,  enabling  an 
Interaction  between  systems  for  mutual  benefits. 

It  is  this  latter  aspect  of  integration  that  will  be  rurther  discussed  in  this 
paper.  However  it  is  likely  that  future  aircraft  will  be  designed  to  encompass  the 
advantages  of  all  3  aspects. 

The  mechanism  for  integration  of  the  powerplant  and  the  aircraft  will  be  based 
upon  a  system  for  control  of  the  aircraft  Utility  Systems  which  is  based  upon  extensive 
use  of  digital  data  transmission  systems  (2). 


UTILITY  SYSTEMS 

The  Utility  Systems  of  the  aircraft  have  been  classified  as  those  relating  to  the 
base  mechanical  functions  suoh  as  Fuel  Gauging  and  Hanagement,  Environmental  Control, 

;  Hydraulics,  Secondary  Power,  etc.  Work  conducted  at  British  Aerospace,  Warton  has  led 

to  the  proposal  of  an  Integrated  Computing  System  operating  on  a  standard  multiplex 
i  data  bus  as  shown  in  Figure  1 . 

I 

,  In  this  diagram  the  Utility  Systems  Management  Processors  perform  the  tasks  of  : 

•  Data  Acquisition  from  connected  sub-system  sensors. 

I  •  Performance  of  control  and  self  test  algorithms, 

j  •  Control  of  Power  to  connected  sub-system  loads. 

The  Processors  form  a  link  to  other  data  bus  systems  on  the  aircraft  and  provide  a 
means  of  interfacing  the  essentially  individual  mechanical  components  and  elements  of 
A  control  into  an  aircraft  architecture  based  on  serial  digital  data  transmission  and 

using  sophisticated  techniques  for  information  presentation  in  the  cockpit. 

The  interconnection  of  aircraft  data  busses  enables  dats  to  be  transferred  between 
major  system  blocks  eg  Flight  Control,  Avionics,  Cockpit,  Weapons,  eto  whilst  retaining 
adequate  separation  of  systems  to  allow  the  application  of  well  proven  methods  of 
procurement  and  testing. 


I 


lat-intM  Components 


FIG.  1.  UTILITY  SYSTEMS  MANAGEMENT 


PROGRESSIVE  INTEGRATION  OF  POWERPLANT  CONTROL 

Since  the  majority  of  the  constituent  systems  of  Utility  Systems  Management  are 
essential  to  the  continued  and  safe  operation  of  the  aircraft  Utility  Systems 
Management  provides  a  sound  basis  for  the  Integration  of  Powerplant  Control  into  the 
airframe  system  architecture  In  such  a  way  that  progressive  changes  to  accommodate 
technology  Improvement  and  Increasing  integration  can  be  achieved  with  minimum 
disturbance  to  the  systems  configuration. 

In  Figure  2a,  for  example,  an  analogue  Powerplant  Control  System  is  shown 
connected  to  the  Utility  Systems  Management  Processors  in  such  a  way  as  to  use  the 
analogue  and  discrete  interfaces  to  provide  a  means  of  integrating  with  a  ditltal 
alroraft  system. 

The  provision  of  spare  stub  coupling  units  on  the  data  bus  will  allow  a  full 
digital  oontrol  system  with  the  appropriate  remote  terminal  hardware  to  be  connected  to 
the  utility  Systems  Data  Bus.  This  digital  control  unit  can  be  either  airframe  or 
engine  mounted  depending  on  the  alie  and  complexity  of  the  unit  and  the  likely 
operating  environment  of  the  aircraft  (1). 

In  this  way  the  aircraft  manufacturer  can  design  a  project  configuration  to 
minimise  development  risk  by  selecting  current  technology  for  engine  control,  whilst 
allowing  the  option  of  progressive  updating  at  minimum  Incremental  cost.  For  example 
one  can  update  from  airframe  mounted  analogue  to  airframe  mounted  digital  to  engine 
mounted  digital  with  minimum  change  to  wiring  as  Illustrated  In  Figure  2a,  b  and  c 
respectively. 
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FIG.  2a.  INTEGRATION  OF  AN  ANALOGUE  POWERPLANT  CONTROL  SYSTEM 


In  Figure  2a  an  analogue  engine  control  system  is  shown  which  comprises  a 
Powerplant  Control  Unit  and  a  number  of  ancillary  units.  These  items  are  connected  to 
the  engine  by  a  large  number  of  wires.  To  provide  an  interface  with  a  data  bus  type 
system  implementation  the  items  need  to  be  connected  to  Utility  Systems  Management  with 
a  similarly  large  number  of  wires. 

Figure  2b  shows  a  system  in  which  the  functions  of  the  ancillary  units  are 
Integrated  into  a  single  Powerplant  Control  Unit. 

This  retains  the  analogue,  hard  wired  connections  to  the  engine,  but  can  be 
connected  to  Utility  Systems  Management  in  conventional  analogue  fashion  (shown  in 
broken  lines  at  "a")  or  alternatively,  and  preferably,  using  the  stubs  onto  the  Utility 
Systems  data  bus  (shown  at  "b".). 

In  the  diagram  the  distance  "d"  represents  the  distance  between  the  powerplant 
connector  Interface  with  the  airframe  and  the  Powerplant  Control  Unit.  This  wiring 
represents  a  weight  penalty  of  approximately  2  Kg/m  which  can  be  reduced  by  locating 
the  Powerplant  Control  Unit  close  to  the  engine.  In  Figure  2c  the  Control  Unit  is 
shown  integrated  with  the  Powerplant,  thereby  reducing  the  majority  of  the  data 
exchanges  to  the  Utility  Systems  Data  Bus  connection. 

Purther  Integration  and  the  use  of  digital  techniques  has  been  shown  to  allow  a 
significant  simplification  of  the  engine  hydromechanical  components  with  consequent 
reduction  in  weight  and  cost  ( 1 ) . 


BENEFITS 

The  benefits  of  even  this  limited  amount  of  integration  are  significant  in  terms 
of  the  flexibility  allowed  to  the  airframe  designer  in  his  freedom  to  make  early  design 
decisions,  whilst  allowing  for  technology  improvements  with  little  capital  investment 
at  the  beginning  of  the  project. 


9-6 


Available  also  are  the  benefits  accruing  from  integration  -  those  associated  with 
weight,  cost  and  performance  configuration  (1). 

•  Weight  Reduction  -  resulting  from  reduction  in  wiring  and  connectors  on  the 

airframe  and  from  simplification  of  hydromechanical  components  on  the 
engine.  This  has  been  estimated  to  save  170  Kg  for  one  particular 
configuration  (1). 

•  Wiring  Reduction  -  mainly  arising  from  mounting  the  electronic  control  hardware 

on  the  engine  and  continuing  the  data  bus  connection  across  the 
engine/airframe  interface.  This  has  been  estimated  to  reduce  the  number  of 
individual  wires  connecting  the  airframe  to  the  powerplant  wiring  by  a 
factor  of  15  (1). 

•  Cost  Reduction  -  arising  from  the  simplification  of  hydromechanical  components 

which  currently  contain  many  complex  casting  and  machining  operations  in 
their  manufacture. 

•  Maintenance  -  improvements  are  expected  from  the  ability  to  communicate  with  a 

sophisticated  Maintenance  Monitoring  System  which  will  reduce  diagnostic 
time.  Simplification  of  fuel  system  components  should  result  in  reduced 
potential  for  wear  and  manufacturing  error  with  consequent  reduction  of  the 
need  for  adjustments,  a  reduction  in  engine  running  hours,  and,  as  a  direct 
result  of  improved  reliability  a  reduction  in  the  need  to  remove  components 
with  long  change  times. 

•  Development  Flexibility  -  arising  from  the  ability  to  gain  access  to  pre-set 

datum  values  in  the  control  system  by  means  of  data  entry  devices  eg  the 
cockpit  keyboards  or  Maintenance  Data  Panel  Keyboard.  This  means  of 
changing  datum  values  with  the  control  system  hardware  in  situ  can  reduce 
engine  change  time,  particularly  if  values  need  to  be  changed  during  engine 


*  Reliability  -  improvements  resulting  from  a  simplification  in  the  engine  fuel 

system  components.  This  combined  with  improved  electronics  and  sensors  has 
been  estimated  to  provide  a  5  fold  improvement  in  MTBF  (3). 

•  Safety  -  reduced  probability  of  consequential  hazardous  effects  following 

single  engine  failures  by  use  of  a  suitable  automatic  aircraft  load  shedding 
routine . 


DEVELOPMENT  OF  THE  INTEGRATED  SYSTEM 

The  integration  of  the  Powerplant  and  its  control  system  into  the  aircraft  Utility 
Systems  architecture  enables  the  system  designer  to  take  advantage  of  data  within  the 
system  or  to  envisage  data  that  can  now  be  made  available  to  improve  his  overall  system 
design . 

For  example  it  is  possible  to  obtain  information  about  the  power  offtake  load 
taken  from  the  engine  by  inspection  of  the  pilot's  actions,  the  Utility  Sub-systems  and 
the  Avionic  Systems  during  the  course  of  a  mission. 

Monitoring  of  pilot  selections  and  Avionic  Equipment  mode  selections,  together 
with  its  own  knowledge  of  internal  control  functions  leading  to  automatic  load 
selections  allows  USM  to  continuously  monitor  the  state  of  connected  electrical  loads. 

As  an  example,  consider  the  system  shown  in  Figure  3  which  is  representative  of  a 
typical  combat  aircraft  total  system  fit  -  Avionics,  Weapon  Systems,  Countermeasures, 
Radar,  Utilities  etc.  Each  of  these  sub-system  classes  will  contain  loads  which  vary, 
either  continuously  or  discretely,  thus  presenting  either  smooth  variations  or  step 
changes  in  connected  load.  Examples  of  this  latter  mode  of  operation  are  De-Icing  or 
Electronic  Countermeasures  which  impose  large  step  electrical  loads  at  certain  stages 
in  the  mission  according  to  atmospheric  conditions  or  mission  requirements. 

On  current  powerplant  installations  it  has  not  been  practical  to  measure  offtake 
shaft  torque,  therefore  the  operation  of  engine  Bleed  Valves,  for  example,  is  usually 
scheduled  with  altitude  and  airspeed  but  cannot  be  modified  by  offtake  power.  As  a 
result  it  is  often  the  ease  that  the  bleed  valves  are  opened  at  a  fixed  point  in  the 
flight  envelope,  which  leads  to  an  unnecessary  restriction  in  engine  power  by  premature 
air  bleed  selection.  Utility  Systems  Management,  with  its  access  to  all  systems 
connected  to  data  busses,  can  obtain  information  related  to  mode  selections  and  pilot 
selections  as  well  as  automatic  operations  that  can  be  used  to  determine  a  sufficiently 
accurate  estimate  of  total  connected  load  throughout  the  mission.  This  can,  in  turn, 
be  used  by  the  Engine  Control  System  to  modify  fuel  flow  or  bleed  valve  schedules  as 
necessary.  This  transfer  of  information  is  shown  diagramatically  in  Figure  4. 
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The  connected  systems  1,  2,  7 ,  *4 . N  are  assigned  an  Identifier  I.  (i  =  1 . N) 

which  is  received  by  Utility  Systems  Management  from  each  connected  equipment  when  that 
equipment  is  considered  to  be  ON  or  in  an  active  condition.  Some  equipments  may 
require  more  than  one  identifier  to  indicate  which  mode  they  are  selected  to  if  mode 
selection  significantly  affects  their  load  characteristics.  Utility  Systems  Management 
assigns,  for  each  I  ,  a  load  value  P,,  which  is  calculated  to  take  into  account  the 
nature  of  the  load  and  its  effect  on1  the  generation  system.  This  calculation  will 
include  Load  Power,  Reactance,  Nature  -  continuous  or  intermittent,  and  may  be  entered 
into  a  look-up  table  in  the  Utility  Systems  Management  software. 

Utility  Systems  will  then  calculate  e  sum  of  all  connected  loads,  £P.  and  output, 
a  data  value  to  Powerplant  Control  which  is  a  function  of  total  connected  load  - 
fdPj).  This  total  can  be  made  to  represent  air  bleed  and  hydraulic  offtake  demands  as 
well  as  electrical  loads.  The  powerplant  Control  System  will  then  use  this  data  to 
perform  whatever  functions  are  required  to  maintain  efficient  engine  operating 
conditions  in  the  presence  of  the  connected  loads  and  other  external  conditions.  This 
action  may  involve  operation  of  Bleed  valve,  scheduling  of  Inlet  Guide  Vane  position, 
or  modulation  of  Fuel  Flow. 

This  same  information  can  be  used  in  a  "Load  Management"  function  to  perform  a 
selective  load  shedding  action  in  the  Single  Engine  failure  case  :  Rapid,  automatic 
load  shedding  can  reduce  the  impact  of  the  transfer  of  offtake  load  to  the  remaining 
engine . 

As  a  result  of  this  action  the  following  additional  benefits  can  be  expected  : 

*  Fuel  Savings  -  resulting  from  the  use  of  system  data  to  optimise  engine  control 

laws  both  at  the  design  stage  and  also  continuously  during  engine  operation. 

•  Performance  Benefit  -  resulting  from  the  ability  to  design  the  engine  and  its 

control  system  laws  to  take  advantage  of  a  knowledge  of  connected  offtake 
loads  and  to  protect  the  engine  from  the  effects  of  sudden  changes  in  load 
and  hence  maximise  the  useful  flight  envelope. 


FLIGHT  CONTROL  INTEGRATION 

Aerodynamic  and  configuration  studies  carried  out  at  Warton  have  shown  that 
integration  of  flight  control  and  powerplant  vectored  thrust  operation  is  essential  in 
situations  where  aerodynamic  control  surfaces  have  little  effect,  eg  Ultra  Short  Take 
Off,  Hover,  Vertical  Landing  and,  to  some  extent,  in  Post  Stall  Manoeuvring.  It  is 
achieved  by  arranging  for  the  flight  control  system  to  demand  changes  in  the  magnitude 
and  direction  of  the  thrust  vector(s)  in  a  co-ordinated  fashion  in  response  to  pilot 
demands  utilising  stick,  pedal  and  nozzle  deflection  control  with  appropriate  control 
functions.  Combat  manoeuvrability  can  be  similarly  enhanced,  and  engine  handling 
should  be  improved  in  poor  intake  airflow  conditions,  eg  very  high  incidence. 

Independent  manual  flight  and  engine  control  in  all  flight  modes  is  only  practical 
on  aircraft  such  as  the  Harrier  because  of  the  simple  nozzle  vectoring  system  (rotation 
in  one  plane).  Even  in  this  case  the  low  speed  operation  is  at  the  expense  of  a  high 
pilot  workload  requiring  the  use  of  five  independent  controls.  Separation  of  flight 
control  and  powerplant  control  is  expected  to  result  in  an  unacceptably  high  pilot 
workload  in  future  aircraft  employing  thrust  vectoring  in  more  than  one  plane.  Some 
attractive  configurations  may  well  then  be  brought  into  practical  consideration  by 
judicious  blending  of  automatic  and  manual  control  eg  twin  engine,  tilting  nacelles 
with  deflecting  nozzles  operating  in  two  planes. 

Preliminary  aerodynamic  studies  and  simulation  work  have  shown,  however,  that  even 
aircraft  with  these  particularly  severe  control  requirements  can  be  confidently 
proposed  (4). 

For  future  projects  it  is  expected  that  data  exchanges  between  Flight  Control  and 
Powerplant  Control  Systems  will  allow  the  aircraft  to  be  handled  equally  confidently  in 
combat  as  in  the  transition  from  airborne  to  jet-borne  flight. 

Work  is  in  progress  at  British  Aerospace  in  conjunction  with  Rolls-Royce  to 
further  examine  the  aspects  of  tightly  integrated  systems.  This  work  will  be  supported 
by  extensive  simulation  activity  with  models  of  various  engine  and  airframe 
configurations  aimed  particularly  at  Advanced  STOVL  aircraft. 

The  integrity  aspects  of  the  Powerplant  Control  System  are  receiving  attention 
particularly  with  regard  to  providing  fault  tolerant  architectures  with  emphasis  on 
use  in  integrated  systems  (5). 


CONCLUSIONS 


Data  is  available  in  Utility  Systems  Management  which  can  be  used  to  obtain  an 
accurate  indication  of  total  offtake  load  and  can  be  used  to  allow  prediction  of 
increased  demand.  This  information  can  be  used  to  allow  the  engine  to  operate  with 
more  precise  control  of  air  bleed  valves  to  obtain  better  control  of  thrust  throughout 
the  flight  envelope. 

The  current  implementation  of  Utility  Systems  Management  can  be  used  to  obtain  the 
requisite  information  and  perform  the  calculations  provided  that  the  information  is 
made  available  in  the  connected  systems. 

The  ideal,  totally  integrated  system  is  shown  in  Figure  2c  in  which  an  engine 
mounted,  twin  lane,  fault  tolerant  powerplant  control  system  is  connected  by  data  bus 

to  a  Utility  Systems  Management  System  for  intercomraunicQ„ _  ^ith  aircraft  systems  and 

flight  control  with  a  directly  connected  thrust  demand  unit. 

This  system  configuration  allows  full  interaction  between  the  Powerplant  Control 
System  and  the  airframe  systems  using  the  data  bus,  on  which  data  interactions  can  be 
used  to  the  mutual  benefit  of  all  systems. 

The  potential  benefits  are  summarised  in  Figure  5  which  shows  from  which  aspect  of 
integration  they  are  derived. 


FIG.  5.  POTENTIAL  BENEFITS  OF  VARIOUS  ASPECTS  OF  INTEGRATION 
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SUMMARY 

^Tbe  paper  describes  the  architecture  and  construction  of  the  system  being  applied 
to  the  Pegasus  engine  and  aimed  at  the  AV8B  application.  The  system's  architecture  was 
particularly  determined  by  the  requirements  of  a  single  engined  VSTOL  aircraft.  It  Is 
essentially  a  dual-dual  system.  This  architecture  was  chosen  to  provide  reliable  and 
positive  detection  of  failure  with  rapid  reaction  and  no  degradation  of  performance. 

The  paper  discusses  the  likely  extension  of  this  system  to  the  control  of  plenum 
chamber  burning  (PCB). 

The  system  includes  a  data  bus  terminal  in  each  lane  of  the  system.  This  provides 
a  communication  path  between  the  engine  control  and  EMC  system  in  the  aircraft.  A 
similar  terminal  could  provide  a  path  through  which  the  operation  of  the  flight  control, 
the  weapon  control  and  the  engine  control  systems  could  be  Integrated.  This  integration 
1 8  required  because  of  interaction  between  the  operation  of  the  engine  and  the  release 
weapons,  the  attitude  of  the  aircraft  and  the  mechanics  of  these  interactions  and  the 
principles  employed  in  the  mitigation  of  their  effects. 


1.0  INTRODUCTION 


This  paper  addresses  the  particular  case  of  VSTOL  aircraft  using  vectored  thrust. 
DSIC  has  supplied  a  FADEC  for  flight  evaluations  on  a  Pegasus  engine  in  a  single 
seat,  single  engined  Harrier  VTOL  aircraft.  (1),  (2),  (3),  (4).  This  flight 
demonstrator  system  (5)  is  described  Initially  followed  by  the  definitive  system 
currently  being  designed  and  built.  The  definitive  system  is  aimed  at  the  AV8B 
application  of  the  Pegasus  engine. 

2.0  THE  PRESENT  SYSTEM 


The  present  engine  control  system  on  the  Pegasus  engine  (6)  is  a  hydromechanical 
control,  with  an  electronic  temperature  limiter,  and  has  an  emergency  system 
fitted.  The  emergency  system  Is  required  because  any  failure  in  the  engine 
control  Itself  which  leads  to  loss  of  thrust  or  engine  shut-down  would  have  a 
catastrophic  effect  for  the  aircraft.  The  emergency  system  was  fitted  with  the 
control  from  the  first  flight  and,  as  yet,  no  accident  of  the  aircraft  has  been 
attributed  to  control  failure. 

The  emergency  system  Itself  is  very  simple.  The  control  of  the  engine  is  by 
modulation  of  a  valve  coupled  to  the  shut-off  valve  and  directly  operated  by  the 
pilots  lever  as  shown  in  Figure  1.  A  changeover  valve  by-passes  and  disconnects 
the  main  metering  valve  in  order  to  engage  the  emergency  system.  It  also 
disconnects  the  limiter  by-pass  valve  and  back-flow  is  prevented  by  a  check  valve 
in  the  downstream  line  from  the  metering  valve  delivery.  In  normal  operation  the 
shut-off  valve  is  fully  open  and  the  manual  flow  control  is  therefore  set  to  a 
flow  determined  by  the  lever  position.  For  changeover  from  the  normal  operation 
to  emergency  operation  the  manual  flow  control  Is  returned  to  the  idle  stop  by 
means  of  the  pilot's  lever  and  the  changeover  valve  is  operated  by  means  of  a 
switched  solenoid.  Once  the  changeover  valve  has  moved  to  the  emergency  position 
then  the  throttle  lever  can  be  advanced  to  an  appropriate  thrust  setting.  This 
procedure  is  required  in  order  to  prevent  surge  were  the  changeover  valve  to 
operate  while  the  manual  flow  control  was  selecting  a  high  flow. 

Figure  2  shows  the  block  diagram  for  the  system  with  the  changeover  selection  from 
normal  operation  using  the  hydromechanical  control  plus  temperature  limiter  to  the 
manual  flow  control  operation.  The  electronic  limiter  has  a  multiple  datum 
selection  and  muting  switch. 

The  nomzle  setting  Is  commanded  from  a  separate  lever  In  the  cockpit  and  is 
positioned  by  an  Independent  follow-up  servo. 


3.0  DEMONSTRATOR  SYSTEM 


The  demonstrator  system  is  shown  in  Figure  3.  It  uses  two  electronic  control 
lanes,  one  of  full  capability  and  one  of  reduced  capability.  The  system  normally 
operates  using  the  main  digital  electronic  control  but  switches  automatically  to 
the  emergency  control  when  the  main  electronics  fails*  The  predicted  probability 
of  both  the  electronic  controls  failing  is  very  much  lower  than  the  probability  of 
failure  of  the  hydromechanical  control  which  they  replace.  Frequency  of  reversion 
to  the  manual  flow  control  should  therefore  be  lower  than  with  the  existing  system 
but.  for  safety,  the  manual  flow  control  was  retained.  The  sain  areas  of  interest 
in  the  design  were  the  definition  of  the  capability  of  the  partial  control  lane 
and  of  the  production  configuration. 

The  system  comprises  two  major  components  as  shown  In  Figure  4.  The  hydromechanical 
section  is  adapted  from  the  current  system.  As  shown  in  Figure  Sit  retains  the 
same  basic  hydromechanical  circuit  schematic  as  the  existing  system. 

However,  an  electro-hydraulic  interface  is  provided  with  the  fuel  metering  valve 
which  allows  either  of  the  two  electronic  control  lanes  to  position  the  valve 
through  a  stepper  motor  interface.  The  electro-hydraulic  interface  Includes  a 
mechanclal  P3  multiplier  and  the  electrical  command  to  the  system  is  for  WF/P3 
(fuel  flow  divided  by  CDP). 

The  mechanical  reversionary  system  is  unchanged. 

3.1  INSTALLATION 

The  electronic  module  shewn  in  Figure  4  Is  engine  mounted,  being  carried,  as 
illustrated  in  Figure  6 ,  by  a  frame  cantilevered  from  the  hydromechanlcai  module. 

It  i 8  vibration  isolated  and  fuel  cooled  as  a  single  unit  and  the  electronics  are 
withdrawn  as  a  single  block. 

The  environment  in  which  the  control  system  is  located  is  extremely  hostile.  Bay 
teng>eratures  of  up  to  150*C  can  occur  for  short  periods  after  shut-down,  while 
heat  is  soaking  from  the  engine  Into  the  engine  bay.  In  normal  operation,  the 
fuel  temperature  used  for  cooling  Is  low,  but  It  can  peak  to  temperatures  above  80*C 
for  fairly  long  periods  during  some  types  of  operation. 

The  main  area  of  attention  in  this  design  is  keeping  good  thermal  paths  between 
the  components  themselves  and  the  coolant.  Particular  attention  has  been  given  to 
areas  of  metal  contact  within  the  design  of  the  unit  and  the  thermal  washers  and 
gaskets  are  used  in  order  to  secure  low  thermal  Impedances  at  critical  points  In 
the  design. 

The  method  of  assembly,  Illustrated  in  Figure  7,  uses  metal  frames  which  carry 
pairs  of  circuit  boards.  Each  board  has  a  copper  facing  which  runs  under  the 
components  and  is  clamped  between  the  board  and  the  frame.  The  frame  Itself  Is 
clamped  to  the  case  through  which  fuel  clruclates.  The  fuel  passage  lies 
immediately  below  the  shoulder  on  which  the  frame  Is  clamped.  This  arrangement 
provides  the  minimum  number  of  Interfaces  and  the  shortest  possible  path  between 
Individual  components  and  the  fuel.  The  frame  also  stiffens  the  whole  assembly 
and  improves  its  mechanical  Integrity. 

The  front  section  of  the  case  forms  an  enclosure  behind  the  connectors.  EIIC 
filters  are  mounted  on  a  bulkhead  at  the  back  of  this  enclosure. 

The  power  supply  Is  Installed  In  a  second  enclosed  volume  on  one  side  of  the 
unit.  This  arrangement  provides  two  benefits.  First,  It  excludes  from  the  main 
electronics  compartment  interference  generated  by  the  switching  regulators  in  the 
power  supply.  Secondly  It  allows  high  dissipation  components  to  be  mounted 
directly  on  the  case. 

Figure  8  shows  one  of  the  demonstrator  units  opened  and  the  modules  separated  to 
expose  all  components.  The  wiring  shown  is  strictly  a  feature  of  the  prototype 
construction.  Flexible  film  wiring  would  be  used  In  production. 

3.2  CONTROL  LAVS  AND  PERFORMANCE 

Figure  9  shows  the  control  functions  provided  by  the  system.  Water  modulation  is 
an  optional  feature. 

The  control  laws  provide  for  steady  state  control  of  thrust  by  governing  the  fan 
speed.  A  range  of  ratings  is  used  to  permit  short  lift  and  "wet"  engine  operation 
in  vertical  lift  operation.  Rating  selection  Is  made  automatically  by  logic  using 
several  state  signals  defining  configuration  and  operating  mode.  Similar  logic 
selects  one  of  up  to  7  datums  for  the  T6  limiter.  Additional  protection  for  the 
engine  is  provided  by  a  non-dimensional  NH  limiter. 


The  system  provides  full  transient  control  during  acceleration  and  deceleration  to 
avoid  compressor  surge  or  flame-out  respectively.  The  system  provides  automatic 
starting  and  transient  reduction  of  fuel  flow  during  weapon  release  to  avoid  gun- 
gas  Ingestion. 

The  system  uses  conventional  low  and  high  error  selection  gates  to  ensure  that  the 
correct  control  loop  is  closed  onto  the  engine  at  any  time. 

3.3  SAFETY  &  MONITORING 

The  system  provides  automatic  failure  detection  and  response  to  failure.  Where 
failure  is  detected  the  stepper  motor  drive  is  inhibited,  the  output  is,  therefore, 
frozen  and  the  signal  line  to  a  changeover  relay  is  activated.  Ibis  relay  sets  in 
train  the  necessary  actions  to  effect  reversion  to  whichever  system  is  neat  to  be 
used. 

The  main  control  lane  uses  dual  microprocessors  which  are  cross-compared  to 
provide  very  high  fault  coverage.  Most  Inputs  are  either  dual  redundant  or,  as  do 
resolvers,  have  dual  outputs  which  can  be  compared  using  an  algorithm  such  as 
sin  +  cos^  «  1.  The  engine  speed  signals  can  be  compared  by  using  known 
relationships  between  HP  and  LP  shaft  speeds.  The  only  input  variable  not 
monitorable  by  comparison  is  the  T6  signal  generated  by  an  8-thermocouple  harness. 
Individual  couple  failures  only  result  in  inaccuracy. 

The  outputs  are  monitored  by  position  pick-offs  driven  by  the  stepper  motor.  A 
failure  in  either  the  motor  or  the  pick-off  is  immediately  detectable.  In  effect, 
the  main  lane  is  a  duplex  sub-system  with  very  high  failure  detection  probability. 

The  emergency  electronic  control  uses  a  single  mlcroprossesor ,  single  sensors,  and 
software  monitoring.  This  was  considered  adequate  with  pre-flight  checks  on  each 
flight  and  its  being  called  into  use  only  after  the  main  lane  had  failed. 

Attitude  control,  as  well  as  lift  in  vertical  flight  depends  upon  the  engine. 
Furthermore,  there  is  no  store  of  energy,  such  as  the  rotor  in  a  helicopter,  which 
can  be  drawn  on  in  an  emergency.  Neither  is  it  possible  to  recover  aerodynamic 
control  without  great  loss  of  height.  It  follows  that  the  major  design  objective 
is  that  a  first  electronic  failure  be  detected  with  very  high  confidence  and  that 
control  be  restored  rapidly  and  automatically  in  response  to  that  detection  of 
failure.  This,  the  system  is  designed  to  achieve. 

The  demonstrator  system  has  been  evaluated  over  the  full  flight  envelope  of  the 
Harrier,  including  tests  in  hovering  flight. 

4.0  DEFINITIVE  SYSTEM 

The  demonstrator  system  for  Pegasus  uses  one  and  a  half  lanes  of  electronics.  The 
complexity  of  the  reversionary  lane  depends  on  the  amount  of  capability  required 
to  be  retained  after  a  failure  in  the  main  electronics  control.  In  principle,  the 
inputs  to  the  partial  lane  can  be  reduced  to  two  and  the  monitoring  of  the  partial 
lane  can  be  eliminated  completely.  Various  increasing  levels  of  complexity  and 
sophistication  are  possible  from  this  base  depending  upon  the  degree  of  capability 
required  to  be  retained  after  the  first  failure.  However,  retention  of  mission 
capability  after  a  first  failure  and  simplified  logistics  led  to  the  selection  of 
a  system  using  two  identical  lanes  for  the  definitive  system.  (Figures  10  and  11). 

It  uses  the  same  basic  methods  of  procedure  as  the  Demonstrator  system  but  is 
adapted  to  use  two  extended  "main"  lane  controllers  in  place  of  the  two  dissimilar 
lanes.  It  embodies  two  relevant  additions  to  the  Demonstrator  system.  The  first 
of  these  is  a  digital  data  bus  interference  for  communication  with  other  equipment 
in  the  aircraft.  The  second  is  the  addition  of  an  angle  of  attack  input.  This  is 
used  to  reset  the  control  to  allow  for  the  reduced  surge  margins  experienced  at 
high  incidence.  The  construction  of  the  system  is  similar  to  that  described  for 
the  demonstrator. 

In  the  longer  term,  extensive  development  of  the  system  can  be  envisaged  to  match 
the  expected  progress  in  V8T0L  aircraft  design  and  operation.  It  is  expected  that 
supersonic  versions  of  this  type  of  aircraft  will  be  designed  and  built  <7).  Such 
aircraft  will  probably  embody  plenta  chamber  burning  (PCB).  This  corresponds  to 
an  augmentor  system  in  conventional  turbo-fan  and  turbo-jet  engines  and  provides  a 
significant  Increase  in  thrust.  The  addition  of  this  feature  to  the  engine, 
giving  supersonic  capability  to  the  aircraft,  will  require  extensions  of  the 
control  capability  in  the  future.  The  control  requirements  for  PCB  are  similar  to 
those  used  by  D8IC  in  the  control  of  P880  and  Adour  engines  (8)  and  (0). 
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PCB  control  Is  essentially  the  sane  as  a  two  gutter  augmentor  system.  The  dry 
engine  systea  will  require  the  additions  shown  In  Figure  12.  A  variable  nozzle  Is 
required  and  two  metered  fuel  flows  could  be  Involved.  The  control  laws  used 
would  be  similar  to  those  for  normal  augmentors  with  a  pressure  ratio  control  of 
nozzle  area  and  non-dimensional  schedules  of  fuel  flow. 

Changes  required  of  the  system  will,  typically,  be  the  addition  of  one  input 
variable  and  three  output  channels  to  each  lane.  Complete  duplication  sill  be 
mandatory  if  PCB  is  used  in  Jet-borne  STOVL  flight. 

Both  the  demonstrator  system  and  the  definitive  system  use  the  existing  nozzle 
control  and  variable  guide-vane  control  as  the  standard  engine.  Both  also  have 
the  same  type  of  hydromechanical  emergency  system  as  the  existing  fuel  control  - 
However,  the  definitive  system  uses  repackaged  hydromechanics  with  the  electronics 
mounted  separately  on  the  fan  case.  The  new  configuration  uses  the  same  drives 
and  mounting  points  as  the  existing  system  but  exhibits  a  significant  reduction  in 
weight  and  complexity. 

5.0  FLIGHT  CONTROL/ ENGINE  CONTROL  INTERACTION 


There  are  many  manifestations  of  interaction  between  the  airframe  and  the  power 
plant  operating  states.  They  occur  both  in  conventional  wing-borne  flight  and  in 
Jet-powered  hover  and  are  both  static  and  dynamic.  They  all  reduce  to  changes  in 
the  net  aerodynamic  force  vector  on  the  aircraft  and  to  changes  in  its  pitching 
moment. 

Eccles  et  al  (10),  reporting  work  on  this  topic  conducted  by  Dowty  Group  and 
Smiths  Industries  in  1974,  identified  the  following  as  candidate  applications  for 
integration  of  flight  control  and  engine  control  in  VSTOL  aircraft. 

a.  matching  nozzle  angle  to  flight  condition 

b.  offsetting  changes  in  static  margin  following  stores  release,  configuration 
changes  or  fuel  burn 

c.  increase  in  permitted  c.g.  range 

d.  transient  Increases  in  normal  force  during  turning  manoeuvres 

e.  cancellation  of  transient  lift-loss  following  positive  pitch  demands 

f.  improved  turn  performance  when  entered  from  speeds  well  above  the  optimum  and 
when  emergency  loss  is  not  important 

g.  simplification  of  pilot  controls  in  the  pitch  plane  through  non-interacting 
control  of  forward  and  vertical  speed 

h.  reduction  in  trim  flows  bled  from  the  engine  to  the  reaction  controls  in  hover. 

Significant  returns  in  overall  performance  were  predicted  for  many  of  these 
features. 

The  Pegasus  definitive  system  already  provides  for  three  other  interactions: - 

a.  transient  reduction  of  fuel  flow  to  prevent  engine  surge  following  release  of 
miss! lies  or  discharge  of  guns 

b.  compensation  for  reduced  engine  surge  margin^ caused  by  inlet  distortion  at 
high  angles  of  attack 

c.  dynamic  compensation  for  the  effects  on  thrust  of  the  engine  bleed  required 
for  the  reaction  control  of  attitude  iu  the  hover. 

Each  of  theae  three  functions  is  proper  to  the  engine  control  itself  and  responds 
to  signals  derived  from  the  aircraft  state.  Some  of  the  other  Interactions  may  be 
located  in  the  flight  control  system  (FOB)  rather  than  the  engine  control  system 
(ECS)  proper. 

A  clear  thrust  example  of  the  latter  is  the  determination  of  the  best  comblnstions 
of  thrust  and  noszle  angle  for  any  particular  manoeuvre.  These  can  be  defined  by 
napping  techniques  entered  from  the  demsnded  thrust  vector  determined  by  PCS.  The 
FCS  could  then  command  the  engine  power  and  the  nozzle  in  an  open  loop  fashion. 

In  the  absence  of  a  direct  meausre  of  thrust,  this  simple  arrangement  will  be 
sensitive  to  changes  in  engine  performsnce.  It  may  be  preferable  to  place  them 
within  a  closed  loop  control  of  flight  path.  Rowever,  the  principle  that  the  FCS 
lndpendently  commands  the  nozzles  and  engine  power  remains  true. 


The  napping  technique  Is  essentially  one  which  Is  static  or  quasl-statlc.  For 
dynamic  Interaction  It  nay  be  less  easy  to  identify  where  best  the  control  should 
be  located. 

For  instance,  in  configurations  using  "hot"  and  "cold"  nozzles,  differential 
nozzle  modulation  would  produce  a  static  pltbclng  eoeent  which  could  be  used  to 
trio  the  aircraft  and  reduce  the  bleed  taken  to  the  reaction  controls  froo  the 
engine.  It  Is  questionable  whether  this  control  should  be  direct  froo  the  EC8 , 
where  the  other  bleed  effects  are  handled,  or  indirectly  via  the  PCS.  A  cooproslse 
solution  would  be  to  peroit  a  Halted  authority  differential  nozzle  trie  and 
thrust  reset  to  be  commanded  by  the  ECS  with  the  prlae  control  froa  the  PCS.  The 
purpose  of  this  discussion  Is  not  to  advocate  the  use  of  differential  nozzle 
operation  In  order  to  reduce  bleed  but  to  explore  the  iaplicatlon  of  the 
possibility.  The  method  chosen  sight  also  be  used  to  reset  static  margin  following 
configuration  changes,  or  weapon  release. 

All  jet  powered  VSTOL  aircraft  do  not  benefit  froa  the  positive  ground  effects 
experienced  by  helicopters.  Indeed,  the  effects  of  re-ingestlon  can  result  in  a 
negative  ground  effect  with  thrust  reducing  as  the  aircraft  approaches  touch-down 
and  the  re-lngestion  effect  is  amplified.  This  effect  could  be  alleviated  by  a 
simple  addition  to  the  ECS  which  would  increase  the  demanded  thrust  before  touch 
down  In  response  to  some  height  determining  Input.  The  same  function  could 
alternatively  be  located  in  the  PCS  and  operate  on  the  engine  power  demand.  The 
major  factors  affecting  the  choice  would  be  the  severity  of  the  effect  and  the 
general  redundancy  philosophy  of  the  aircraft.  A  determining  factor  would  be  the 
need  for  the  function  combined  with  an  ability  to  land  the  aircraft  in  some 
emergency  mode  with  the  full  PCS  inoperative. 

Aircraft  with  positive  static  margin  require  an  Increase  in  downwards  lift  on  the 
horizontal  stabiliser  in  order  to  Increase  the  pitch  attitude  of  the  aircraft.  This 
results  in  a  transient  "sinking"  effect  immediately  prior  to  generating  the  desired 
pitch  rate.  This  effect  could  be  removed  by  a  combined  downwards  nozzle  deflection 
and  compensating  thrust  increase  which  restore  the  total  aerodynamic  force  to  its 
value  prior  to  the  application  of  the  pitch  command.  This  effect  is  analogous  to 
the  use,  in  a  helicopter  engine  control,  of  collective  pitch  as  an  anticipatory 
signal  to  generate  an  immediate  engine  response  to  rotor  load  and  avoid  the 
transient  loss  of  rotor  speed  which  is  inevitable  with  a  conventional  rotor  speed 
governor. 

This  now  raises  the  issue  of  the  form  of  the  interface  between  the  PCS  and  the  ECS. 
It  could  take  the  form  of  an  autothrottle.  If  so,  the  response  of  the  servo  might 
be  too  slow  satisfactorily  to  operate  in  the  anticipatory  mode.  The  choice  is 
then  either  to  by-pass  the  conventional  power  lever  by  a  fast-acting  limited 
authority  trim  command  generated  by  the  PCS  or  to  feed  the  elevator  signals  to  the 
ECS  in  the  same  way  as  Is  collective  pitch  in  a  helicopter  engine  control.  The 
elevator  signal  used  may  originate  In  the  FC8 .  The  Issue  involved  lies  in  the 
responsibility  for  the  dynamic  response  of  the  arrangement  and  will  probably 
determine  that  it  lies  within  the  PC8,  the  elevator  signal  being  shaped  to  produce 
best  aircraft  performance.  The  ECS  would  incorporate  a  protective  filter  against 
fault  conditions  In  the  command. 

A  further  practical  reason  for  supporting  this  outcome  is  the  difference  in 
development  timescales  between  engine  and  airframe.  Engine  development  normally 
starts  well  ahead  of  airframe  development  and  the  definition  of  the  relationship 
between  elevator  demand  and  tburst  vector  response  is  only  likely  to  occur  late  in 
the  engine  control  development  history.  Changes  to  engine  control  software  at  this 
stage  would  be  undesirable  whereas  no  such  problem  would  occur  were  the  changes  to 
the  implemented  in  the  PCS  where  control  development  Is  probably  still  In  process. 

Direct  control  of  thrust  will  not  be  possible  if  the  aircraft  uses  non-interacting 
control  of  forward  and  vertical  speed.  There  sill  be  no  place  for  an  astothrott le 
In  this  type  of  operation  and  an  entirely  electrically  thrust  command  incorporating 
the  pitch  anticipation  term  would  be  transmitted  from  the  P8C  to  the  B 08. 

At  fixed  fan  speed  the  operating  of  PCB  in  a  Pegasus  type  of  engine  Increases  the 
tburst  from  the  front  ("cold")  nozzles  without  changing  the  thrust  from  the  rear 
nozzles.  The  result,  unless  the  nozzle  thrust  lines  all  pass  through  the  aircraft 
c.g..  Is  a  change  In  pitching  moment  which  must  be  offset  either  by  coordinating 
setting  of  PCB  and  fan  speed  or  by  a  change  in  longitudinal  trim  controls.  The 
trim  control  will  be  on  the  elevator  In  conventional  flight  and  on  reaction  nozzle 
floes  In  hover.  The  trim  control  adjustment  may  be  initiated  In  one  of  at  least 
three  ways:- 

a.  by  the  command  to  the  PCB  control 

b.  by  the  PCB  control  output 

c.  by  the  aircraft  response  to  the  PCB  pitching  moment. 
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Considering  encb  In  turn  It  In  seen  thnt  alternative  (c)  has  slower  reponse  than 
either  (a)  or  (b)  while  alternative  (a)  way  anticipate  a  thrust  change  which  does 
not  occur.  Alternative  (b)  Introduces  a  data  feed  frow  ECS  to  PCS  with  the 
alnlauw  data  content  that  PCB  la  lit  and  hence  the  data  path  between  the  PCS  and 
ECS  will  be  bi-directional  and  any  need  a  data  rate  appropriate  to  the  PCB 
modulation  bandwidth. 

Other  engine  state  slgnala  will  need  to  be  coaaunlcated  to  the  PC3.  The  actual 
engine  thrust  nay  depart  froa  the  expectations  of  the  PCS  because  of  the  operation 
on  the  eoglne  of  soae  protective  lialter  such  as  a  non-dlaensional  speed  or  a 
turbine  blade  temierature  Halt.  The  engine  control  ceases  to  behave  in  a  linear 
fashion  and  the  PC8  can  only  function  correctly  If  the  existence  of  a  fixed  thrust 
condition  is  signalled  to  it.  There  is.  therefore,  a  need  to  tranaait  to  the  PCS 
a  range  of  lnforaation  on  the  operating  state  and  the  controlling  loop  In  the  ECS. 

This  “reverse"  data  flow  can  be  used  in  other  ways.  It  has  been  found  helpful,  on 
large  coaaerlcal  fan  engines,  to  display  to  the  pilot  the  power  deaand  to  the 
engine  which  corresponds  to  the  actual  power  lever  position.  The  pilot  any  then 
position  the  lever  to  generate  the  engine  poser  he  is  seeking  rather  than  aanlpulate 
the  power  level  until  the  actual  engine  power  coincides  with  the  desired  value. 

The  pilot  then  operates  directly  on  the  fast  loop  leaving  the  ECS  to  handle  the 
slower  engine  response.  The  reaoval  of  the  inter-action  between  the  loops  results 
In  a  significant  laproveaent  In  control  perforaance.  The  aethod  Is  equally  valid 
?  '  the  pilot  Is  replaced  by  the  PCS  and  an  autothrottle,  or  other  Intermediate 
control  Interposed  between  the  PCS  and  the  ECS. 

6.0  FLIGHT  CONTROL  AMD  ENGINE  COMTECH,  ISTBGRAT10H 

"Integration",  in  the  context  of  this  paper  has  the  aeanlng  of  asking  the  system 
complete  In  concept  rather  than  Integrating  the  hardware  Into  a  single  entity. 

The  aeans  by  which  this  end  la  achieved  la  exchange  of  data  between  the  various 
systeaa  to  be  integrated  so  that  each  has  available  to  It  all  the  dpta  It  needs 
properly  to  coordinate  Its  actions  with  the  others.  The  data  Is  exhanged  over  a 
serial  digital  data  bus  network.  h 

figure  13  shows  how  the  longitudinal  control  functions  could  be  related  in  a  VSTOL 
or  STOVL  aircraft.  The  only  inter-connections  shown  are  between  Individual 
systeaa  and  the  PCS.  figure  14  shows  the  data  flows  between  the  various  functions 
as  identified  In  the  previous  section-  It  would  appear  logical,  with  an  engine 
aounted  control,  to  coablne  the  coaaand  of  the  noesle  vector  actuator  with  the 
engine  control  hardware.  Integration  of  this  "Thrust  Control  Systea"  with  the 
other  systems  could  then  take  a  fora  similar  to  that  shown  in  Figure  IS. 

The  Integration  of  flight  control  and  engine  control  will  involve  the  bi-directional 
exchange  of  data  between  engine  control  and  flight  control  systems.  This  way  take 
place  over  a  general  data  bus  or  over  a  dedicated  data  systea.  In  either  event, 
more  will  be  Involved  than  staple  data  exchanges  and  more  issues  than  have  been 
raised  In  the  previous  section. 

One  such  Issue  depends  on  the  levels  of  redundancy  in  the  PCS  and  ECS.  It  can  be 
expected  that  the  PCS  will  be  double  failure  surviving  (say  quadruples)  while  the 
engine  control  is  aost  likely  to  employ  soae  fora  of  dual  redundancy.  If  the  data 
bus  systeaa  are  also  redundant  there  Is  a  clear  but  cosplex  issue  to  be  resolved 
on  the  control  of  the  systea  configuration  following  progressive  failure,  the 
routing  of  lnforaation  and  the  prevention  of  fault  propogation.  The  previous 
section  Indicated  how  thin  problem  aay  be  altlgated  by  careful  choice  of  location 
for  a  particular  control  function  and  by  appropriate  llaitatlons  of  control 
authority.  However,  the  aaln  question  cannot  be  addressed  within  the  Halts  of 
this  paper. 

A  second  issue  is  the  "testability"  of  the  systea  and  the  verification  of  its 
operational  status.  This  will  be  an  laportant  consideration  In  the  integration 
of  the  systeaa.  The  methods  outlined  will  siapllfy  the  problea  but  it  will  be 
essential  to  conduct  detailed  studies  of  this  aspect  of  the  Integration  of  the  two 
systeaa  for  each  application. 

It  Is  assumed  that  the  PCS  and  EC8  will  be  digital.  A  third,  and  aajor  issue, 
will  be  the  configuration  control  of  software  la  two  Independent  but  highly 
Interactive  developaent  prograaaea,  one  of  which  Is  controlled  by  the  airfraae 
manufacturer.  This,  rather  than  the  perforaance  Issues  discussed  earlier,  aay 
well  be  the  pivotal  consideration  in  sany  instances. 
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7.0  C0MCLQ3I0N 

Thla  paper  has  described  a  digital  control  system  for  a  VSTOL  engine.  It  has 
described  the  Interactions  between  engine  and  alrfraae  functions  and  shown  how 
aajor  performance  Improvements  could  be  secured.  It  has  also  Indicated  how 
performance,  safety  and  Interface  responsibilities  can  affect  the  partitioning  of 
functions  between  the  PCS  and  ECS.  Finally,  It  has  indicated  some  of  the  major 
considerations  which  the  paper  does  not  address. 
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SUMMARY 

'^'Reliability ,  redundancy,  and  survivability  are  key  issues  as  integrated  requirements 
for  flight  control,  fire  control,  and  propulsion  control  are  developed.  These 
integrated  control  systems  require  dependable  sources  of  inertial  measurement  data. 
Current  inertial  sensors,  however,  are  expensive  to  acquire  and  maintain,  dedicated 
to  specific  systems,  and  are  not  designed  to  meet  integrated  control  reliability, 
redundancy,  and  survivability  requirements.  The  -Mtrltlftmct ion  Flight  Control 
Ref  erenee-^yTtem-fftFCRS  7 concept  uses  a  minimum  number  of  inertial  sensors  in  a 
survivable  configuration  to  provide  inertial  data  for  flight  control,  navigation, 
weapon  delivery,  cockpit  displays,  and  sensor  stabilization.  Because  of  advantages 
in  survivability,  life  cycle  cost,  size,  and  performance,  the  MFCRS  program  was 
initiated  to  verify,  through  flight  test,  the  key  Issues  of  redundancy  management  and 
flight  control A  redundancy  management  system  based  on  parity  equations  was 
designed.  ("Sensor  implementation  consists  of  two  skewed  and  dispersed  sensor 
clusters.  |  Each  cluster  is  an  orthogonal  triad  of  colocated  inertial  quality  ring 
laser  gyros  and  accelerometers.  Testing  showed  noise  levels  were  higher  than 
predicted/  While  the  noise  had  little  affect  on  the  navigation  performance  of  the 
baseline  hardware,  additional  filtering  was  required  for  MFCRS  to  prevent  false 
alarms  and  high  frequency  actuator  response.  This  filtering  affected  the  flight 
control  Stability  and  performance  and  caused  the  flight  control  design  to  be 
modified.^  A  key  lesson  learned  is  that  integration  of  inertial  data  for  fire 
control,  flight  control,  and  propulsion  control  will  require  close  coupling  and 
coordination  between  functional  groups  to  resolve  performance  conflicts  and  com¬ 
promises.  Testing  to  date  has  not  shown  any  basic  flaws  in  the  multifunction  concept  , 
and  flight  test  is  scheduled  in  late  1983. 


1 .  BACKGROUND 

Improvements  currently  being  developed  for  advanced  fighter/attack  aircraft  include 
integration  of  flight  control,  fire  control,  and  propulsion  control  systems.  Also, 
flight  control  is  becoming  more  sophisticated  with  advances  in  trajectory  control  and 
automatic  terrain  following/terrain  avoidance  techniques.  As  these  advanced  develop¬ 
ments  proceed,  formerly  mission  critical  functions  now  become  flight  critical.  The 
high  reliability  and  redundancy  classically  associated  with  flight  control  must  be 
designed  into  these  integrated  systems.  Survivability  is  also  a  major  design  factor 
given  the  increase  of  the  number  and  quality  of  the  threat  air  defense  systems. 
Inertial  data  Is  required  for  all  of  the  advanced  flight  control  techniques  and  is  a 
key  component  in  many  of  the  integrated  systems. 

As  shown  in  Figure  1,  current  operational  fighters  obtain  inertial  data  from  a  number 
of  different  sources  such  as  the  Inertial  Navigation  System  (INS),  the  Attitude 
Heading  and  Reference  System  (AHRS),  the  Flight  Control  Gyros  and  Accelerometers,  and 
the  Fire  Control  Lead  Confuting  Gyro  (1.CC) .  These  sensors  are  dedicated  to  and 
optimized  for  specific  functions.  Current  generation  inertial  sensors  do  not,  however, 
meet  the  reliability  and  survivability  requirements  that  Integrated  systems  will 
need.  For  example,  flight  control  sensors  are  not  considered  survivable  when  the 
gyros  are  clustered  at  a  single  location  near  the  primary  aircraft  bending  antinode 
or  when  the  accelerometers  are  similarly  located  together  at  a  node.  Mission 
critical  sensors  such  as  the  INS  or  LCG  are  neither  redundant  nor  survivable.  This 
will  become  an  Increasingly  important  problem  as  the  INS  outputs  are  used  to  generate 
inputs  to  the  flight  control/ flight  management  system  to  perform  maneuvering  attack, 
automatic  terrain  following/ terrain  avoidance,  or  night,  all  weather  control.  For 
these  functions,  the  Inertial  sensors  are  in  essence  part  of  the  flight  control/ 
flight  management  system  and  should  be  designed  to  meet  the  rigorous  flight  control 
safety  requirements.  Another  problem  with  current  inertial  sensors  is  their  long 
reaction  time.  Current  glmbaled  INS  systems  require  4  to  6  minutes  for  warm-up  and 
alignment  prior  to  baginning  valid  navigation.  Current  inertial  systems  are  also 
costly  to  maintain.  This  is  due  in  part  to  the  fact  that  swat  currant  systems 
require  complex  platform  electronics  to  support  the  electromechanical  glmbaled 
devices.  Also,  each  unique  inertial  data  source  requires  a  dedicated  Interface  which 
must  be  maintained  through  the  existence  of  aircraft  intermediate  shop  support  and 
the  training  of  highly  skilled  maintenance  personnel  in  each  specialty  field. 
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Figure  1.  Conventional  Approach  to  Inertial  Data  Requirements 


The  Multifunction  Flight  Control  Reference  System  (MFCRS)  concept  shown  in  Figure  2 
was  developed  to  solve  these  problems.  (1,2)  The  MFCRS  concept  is  an  innovative 
approach  that  uses  a  minimum  number  of  inertial  sensors  in  a  survivable  configuration 
to  satisfy  the  combined  inertial  data  requirements  of  flight  control,  navigation, 
weapon  delivery,  cockpit  displays,  and  sensor  stabilization.  One  key  element  of  the 
MFCRS  concept  is  the  ring  laser  gyro  (RLG),  The  RLG  in  a  strapdown  configuration 
provides  both  the  accuracy  required  for  navigation  and  the  dynamic  bandwidth  required 
for  flight  control.  The  strapdown  RLG  assembly/cluster  is  also  less  complex  and  more 
rugged  than  the  current  four  gimbal  inertial  platform  since  the  RLG  is  a  solid  state 
device.  The  other  kev  to  the  MFCRS  is  the  availability  of  high  speed  digital  micro¬ 
processors.  Microprocessors  allow  the  wide  variety  of  functions  required  of  the 
MFCRS  to  be  calculated  and  provided  in  real-time.  The  processor  does  fault 
detection,  fault  isolation,  dynamic  reconfiguration,  navigation,  flight  control 
compensation,  and  compensation  required  by  the  other  systems  using  MFCRS  data. 

The  MFCRS  concept  was  initially  investigated  by  the  Multifunction  Inertial  Reference 
Assembly  (MIRA)  program.  (1,2)  The  MIRA  program,  jointly  sponsored  by  the  Air  Force 
Wright  Aeronautical  Laboratories  Flight  Dynamics  Laboratory  (AFWAL/FI)  and  Avionics 
Laboratory  (AFWAL/AA) ,  identified  several  potential  benefits  and  payoffs  for  a 
projected  late  1980's  production  system.  First,  reliability  and  mission  success 
probabilities  would  be  increased  for  all  functions.  This  is  due  to  the  fact  the 
system  could  provide  fail-operate,  fall-operate  flight  control  data,  and  fail-operate 
navigation  and  weapon  delivery  data.  The  MIRA  study  also  estimated  a  21Z  decrease  in 
life  cycle  cost.  This  was  based  on  the  mean-time  between  failures  increasing  from 
'>'■0  hours  to  1,670  hours  and  the  mean-time  to  repair  decreasing  from  2,6  hours  to  1.4 
hours.  Weight  would  also  decrease  from  120  pounds  to  90  pounds  and  only  2  line 
replaceable  units  would  be  required  instead  of  7,  The  RLG  has  a  faster  turn  on  time 
than  the  present  gimbaled  INS  and  reaction  time  could  be  reduced  to  l.S  to  3  minutes 
for  gyrocompass  alignment  and  to  less  than  30  seconds  for  stored  heading  alignment. 

MIRA  also  predicted  a  30Z  improvement  in  combat  survivability  when  the  sensors  were 
dispersed  in  two  clusters.  These  benefits  and  payoffs  are  summarized  in  Figure  3.  (1,2) 
These  increases  in  reliability,  survivability  and  redundancy  afford  the  opportunity 
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to  eliminate  aircraft  Intermediate  shop  (AIS)  maintenance  support  for  inertial 
systems.  Thev  are  also  required  to  support  the  operational  readiness  of  advanced 
weapon  system  functions  such  as  integrated  flight  fire  control,  terrain 
following/ terrain  avoidance,  and  multi-mode  control  laws.  When  the  MIRA  program  was 
completed  in  December  1978,  several  key  issues  were  identified  that  could  not  be 
resolved  in  MIRA's  limited  laboratory  demonstrations.  The  MFCRS  program  was 
initiated  in  May  1980  to  resolve,  through  flight  test,  the  key  Issues  of  redundancy 
management  of  skewed  and  dispersed  sensors  and  the  compensation  required  to  use 
navigation  quality  RLC's  and  accelerometers  for  flight  control  reference  in  an 
advanced  high  performance  fighter.  A  contract  was  awarded  by  the  Flight  Dynamics 
Laboratory's  Flight  Control  Division  (AFWAL/FIG)  to  McDonnell  Aircraft  Company 
(MCAXR)  to  develop  and  flight  test  a  multifunction  unit. 
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2.  BASELINE  DESICN 


The  MFCRS  program  is  intended  to  resolve  the  two  key  issues  discussed  above:  redun¬ 
dancy  management  and  flight  control  compensation,  to  meet  these  objectives  in  a  cost 
effective  manner,  the  MFCRS  program  modified  two  existing  RLG  navigation  units  built 
by  Honeywell  Incorporated  for  the  AV-8B  program.  The  resulting  MFCRS  design  will 
provide  an  adequate  technology  base,  validated  by  flight  test,  upon  which  design 
recommendations  for  a  production  multifunction  prototype  can  be  made.  Figure  4  shows 
the  components  of  the  MFCRS  and  their  location  in  the  F-15  test  aircraft.  Motion 
Reference  Unit  (MRU)  A  is  aligned  with  the  aircraft  axes  and  is  located  on  an  avionic 
shelf  in  the  nose  barrel  of  the  aircraft.  MRU  B  is  located  2.8  meters  aft  and  the 
MRU  is  skewed  60°  about  its  cone  axis  relative  to  the  aircraft  axes.  The  amount  of 
separation  required  for  survivability  was  determined  in  the  MIRA  program  to  be  at 
least  .76  meters.  The  limited  number  of  available  equipment  installation  locations 
on  the  test  aircraft  resulted  in  the  large  separation  for  the  MFCRS  program;  however, 
the  compensation  developed  for  this  separation  will  demonstrate  a  worst  case  situa¬ 
tion.  Demonstrating  this  worst  case  will  provide  additional  flexibility  in  locating 
these  components  in  a  new  aircraft  design.  The  skewing  of  MRU  B  is  necessary  to 
provide  the  redundant  inertial  information  required  to  perform  the  two  fail-operate 
redundancy  management.  Changes  to  the  MRU  electronics  were  required  to  allow  inter 
MRU  communication,  cosmunlcation  with  the  aircraft  instrumentation,  and  communication 
to  the  flight  control  computers.  A  separate  MFCRS  unit  called  the  Test  Management 
Panel  (TMP)  was  built  to  serve  as  both  an  interface  between  the  MRU's  and  the  flight 
control  computers,  and  as  a  test  input/output  source  for  the  pilot.  Because  of 
safety  considerations,  a  switching  unit  was  also  installed  to  allow  selection  of 
either  the  production  aircraft  flight  control  sensors  or  the  MFCRS  sensors. 
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2.1  REDUNDANCY  MANAGEMENT  BASELINE  DESICH 

A  redundancy  management  system  that  compares  the  sensor  outputs  using  parity  equations 
was  chosen  for  Implementation.  (3,4)  As  shown  in  Figure  5,  the  results  of  the  sensor 
comparison,  the  parity  equation  residuals,  are  compared  to  trip  levels  and  the 
results  are  used  as  a  pointer  to  select  the  three  best  sensors  based  on  stored 
tables.  This  approach  of  parity  equations  and  stored  tables  has  a  low  processing 
requirement  which  allowB  the  existing  processor  to  be  used  at  a  50  Hz  processing 
rare.  The  two  key  aspects  of  the  redundancy  management  system  are  1)  the  compen¬ 
sation  to  allow  sensor  outputs  to  be  compared,  and  2)  the  generation  of  the  stored 
tables.  The  sensor  differences  that  act  as  error  sources  and  methods  of  compensation 
are  shown  in  Figure  6. 
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The  first  error  source  Is  the  moment  am  effect  caused  by  the  separation  of  the 
accelerometers.  The  sensed  acceleration  at  MRU  A  Is  corrected  by  a  set  of  deter¬ 
ministic  equations  to  the  HRU  B  location  so  the  outputs  can  be  compared.  The  second 
error  source,  static  misalignments,  are  installation  errors  that  are  normally 
corrected  by  boresighting.  Because  of  the  distance  between  the  two  MRU  locations  and 
the  limited  access,  boresighting  both  boxes  would  not  provide  the  required  accuracy 
and  is  not  feasible.  Conventional  boresighting  is  only  accurate  to  ±6  arcmlnutes 
while  the  MFCRS  redundancy  management  system  requires  the  relative  orientation  of  the 
boxes  to  be  known  to  ±1. 5  arcmlnutes.  The  MFCRS  program  uses  a  unique  approach  of 
boresighting  just  one  box  and  then  using  the  existing  navigation  alignment  algorithms 
to  calculate  the  exact  installation  orientation  of  each  MRU.  The  results  of  the 
navigation  alignments  are  compared  and  used  to  calculate  the  relative  orientation  of 
the  MRU's  to  within  the  required  ±1. 5  arcmlnutes.  This  method  of  making  corrections 
for  static  misalignments  is  faster,  cheaper,  and  more  accurate  than  conventional 
boresighting  and  may  have  future  application  in  determining  the  relative  orientation 
of  remote  Installation  mounts  for  other  systems.  The  third  source  of  error  is  noise 
caused  by  the  mechanical  dithering  of  the  RLG's  to  prevent  "lock  in”  at  low  angular 
rates.  This  dither  noise  affects  both  the  gyro  output,  by  aliasing  into  the  flight 
control  frequencies,  and  the  accelerometer  outputs,  bv  causing  motion  of  the  sensor 
block.  Dither  noise  in  the  gyro  chennel  also  couples  into  the  accelerometer  channel 
through  the  angular  rate  and  angular  acceleration  terms  in  the  moment  arm  equations. 
The  gyro  outputs  require  extensive  filtering  because  Che  differentiation  process  to 
get  angular  acceleration  amplifies  the  dither  noise  and  the  long  moment  arms  add 
further  gain.  Gain  is  also  added  by  the  coefficients  required  to  transform  the  MRU  B 
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outputs  to  the  aircraft  axes.  A  -60  db  digital  notch  prefilter  at  the  dither  fre¬ 
quencies  was  placed  in  the  gyro  path  and  a  third  order  analog  lag  prefilter  was 
placed  in  the  accelerometer  path  to  attenuate  the  noise.  The  next  error  source  is 
the  misalignment  between  the  two  MRU's  caused  by  aircraft  bending  during  high  g 
maneuvering.  To  account  for  this  misalignment,  the  trip  levels  that  the  parity 
equation  residuals  are  compared  against  are  scheduled  as  functions  of  the  sensed 
rates  and  accelerations.  One  major  objective  of  the  flight  test  is  to  validate  the 
trip  level  equations  and  the  aircraft  bending  models  upon  which  they  are  based. 

Sensor  biases  are  accounted  for  during  turn  on  and  warm-up  by  calculating  the  parity 
equation  residuals  under  static  conditions  and  then  using  these  residuals  as  bias 
correction  factors.  With  all  of  the  errors  compensated,  any  miscompares  detected  by 
the  parity  equations  should  be  caused  only  by  incorrect  sensor  outputs.  As 
mentioned  above,  the  status  of  the  parity  equations  is  used  as  a  pointer  in  a  set  of 
look  up  tables  to  pick  the  best  sensor  triad.  The  look  up  table  generation  is  done 
by  an  off  line  program  that  relates  all  possible  parity  equation  states  to  the  sensor 
that  is  most  likely  failed.  The  equations  that  relate  sensor  failures  and  parity 
equation  states  can  be  either  interpreted  geometrically,  or  derived  rigorously  using 
the  Greatest  Likelihood  Ratio  test.  References  3  and  4  contain  a  detailed  discussion 
of  the  redundancy  management  system  and  the  generation  of  the  stored  tables. 

2.2  FLIGHT  CONTROL  BASELINE  DESIGN 

The  other  key  issue  to  be  resolved  by  MFCRS,  the  flight  control  compensation,  is 
shown  in  Figure  7  and  consists  of  two  sets  of  moment  arm  compensations  and  network 
compensations  for  the  selected  gyros  and  accelerometers.  (4,5)  The  first  set  of 
moment  arm  compensations,  as  discussed  above,  corrects  the  sensed  acceleration  at  MRU 
A  to  the  MRU  B  location  for  redundancy  management.  The  second  set  of  equations 
corrects  the  selected  accelerometer  outputs  from  the  MRU  B  location  to  the  location 
of  the  production  accelerometers.  This  second  compensation  allows  switching  between 
the  production  and  MFCRS  accelerometers,  and  avoids  any  changes  in  the  F-15  flight 
control  computers.  The  network  compensation  also  avoids  changes  in  the  flight 
control  computer  by  compensating  for  dynamic  bending  effects  in  the  feedback  loop  of 
the  flight  control  system.  Network  compensation  is  required  since  the  accelerometers 
are  not  located  at  the  primary  aircraft  bending  nodes  and  the  gyros  are  not  at  the 
antinodes.  Instead,  the  accelerometers  and  the  gyros  are  clustered  so  the  system  can 
navigate.  In  MFCRS  this  caused  flight  control  system  sensitivity  to  aircraft  struc¬ 
tural  modes  resulting  in  unacceptable  stability  and  handling  qualities.  Using  the 
baseline  F-15  gain  and  phase  margins  as  design  goals,  the  open  loop  frequency 
response  was  used  to  determine  the  network  filter  requirements  to  achieve  acceptable 
performance.  A  15  db  notch  filter  was  required  in  the  pitch  rate  and  normal  accel¬ 
eration  paths  and  a  30  db  notch  was  required  in  the  roll  path.  The  yaw  path  did  not 
require  compensation  based  on  the  open  loop  frequency  response.  To  offset  the  effect 
of  the  computational  delay,  a  3  db  lag- lead  network  was  placed  in  the  pitch  rate  and 
yaw  rate  feedback  paths.  The  50  Hz  computational  cycle  that  was  used  by  the  naviga¬ 
tion  program  appeared  adequate  for  both  the  flight  control  compensation  and  the 
redundancy  management. 


Figure  7.  MFCW3  FHqM  Control  Compensation  amplified  Block  Plogrom 


12-7 


3.  MODIFICATIONS  OENTIFIED  BY  TESTS/S  lift tLATIONS 

The  baseline  system  design  described  above  has  been  subjected  to  a  number  of  simu¬ 
lations  and  tests.  Based  on  these  results,  modifications  were  required  to  both  the 
redundancy  management  and  flight  control  sections.  Some  of  the  results  suggest 
modifications  that  are  not  within  the  scope  of  this  program,  but  should  be  'lessons 
learned”  for  the  production  prototype  design  of  a  multifunction  system.  The  redun¬ 
dancy  management  test  results  are  discussed  first,  since  some  of  the  required  modi¬ 
fications  impacted  the  flight  control  design. 

3.1  REDUNDANCY  MANAGEMENT  TEST  RESULTS 

The  initial  testing  of  the  redundancy  management  went  smoothly.  To  protect  against 
coding  errors,  MCAIR  developed  a  test  case  which  injected  simulated  gyro  and  accel¬ 
erometer  inputs  into  a  MCAIR  computer  simulation  of  the  redundancy  management  svstem 
Honeywell  had  coded.  Intermediate  results  were  generated  all  the  way  to  the  output 
and  the  inputs  and  results  were  provided  to  Honeywell.  Honeywell  was  then  able  to 
compare  to  the  results  generated  by  the  flight  code  when  the  same  simulated  inputs 
were  used.  This  method  of  testing  was  instrumental  in  assuring  a  very  smooth  soft¬ 
ware  development.  One  of  the  keys  to  the  success  of  this  approach  was«the  fact  that 
the  software  for  the  MCAIR  simulation  and  the  Honeywell  flight  software  were  generated 
by  different  individuals.  This  cheek  and  balance  situation  insured  design  quality. 

The  other  key  was  the  absolute  requirement  that  all  software  changes  must  be  incor¬ 
porated  in  both  sets  of  software,  a  new  test  case  generated,  and  the  Honeywell  and 
MCAIR  results  compared  to  ensure  proper  coding. 

The  first  indication  of  problems  occurred  in  the  software/hardware  integration 
process.  At  this  point  test  data  Indicated  that  the  noise  due  to  RLG  dither  was 
present  on  both  the  accelerometer  and  gyro  outputs  and  was  significantly  larger  than 
predicted  analytically.  This  noise  was  large  enough  to  cause  false  alarms  in  the 
redundancy  management  system.  The  trip  levels  were  raised  to  the  point  where 
additional  increases  would  allow  sensor  failures  to  cause  aircraft  transients  bi 'ore 
they  were  detected.  After  the  trip  levels  were  raised,  the  noise  in  the  MFCRS  was 
measured  in  an  end  to  end  test.  Results  showed  that  the  noise  was  still  unaccept¬ 
able.  and  the  sixth  order  filter  was  not  providing  the  expected  attenuation. 

Analysis  showed  that  part  of  the  problem  waa  RLG  quantization.  The  RLG  measures 
angular  rotation  in  discrete  increments  and  accumulates  these  discrete  rotations  over 
a  set  time  period  to  calculate  rate.  The  Increment  to  which  the  rotation  is 
quantized  creates  quantization  noise  that  raises  the  gyro  path  noise  level  to  a 
-30  db  value  versus  the  -60  db  design  goal.  The  RLG  resolution  can  be  changed  to 
reduce  the  quantization  level,  but  the  effort  is  beyond  the  scope  of  this  program. 

Any  future  system  must  consider  the  flight  control  requirements  in  the  design  of  the 
basic  sensors.  This  problem  does  not  affect  navigation  since  the  outputs  are  inte¬ 
grated  over  a  long  period  of  time  and,  unlike  flight  control,  any  quantization  errors 
average  out . 

In  addition  to  the  gyro  noise  coupled  into  the  accelerometer  path  by  the  moment  arms, 
the  accelerometer  path  also  had  more  noise  than  expected  with  the  third  order  lag 
prefilter.  This  noise  appears  to  be  related  to  the  hardware  implementation  method 
rather  than  any  fundamental  phenomena.  A  careful  redesign  of  the  electronics  with 
awareness  of  the  noise  sensitivity  would  probably  eliminate  the  problem.  The  use  of 
existing  hardware  and  the  limited  scope  of  the  program  did  not  allow  this  compre¬ 
hensive  fix.  Instead  a  first  order  .1  second  lag  filter  was  added  to  the  accel¬ 
erometer  path,  a  5  db  lead  lag  filter  that  had  been  added  for  flight  control  was 
eliminated,  and  the  parity  equation  moment  arm  compensation  was  changed  to  do  the 
parity  equation  comparison  at  a  central  location.  This  last  change  had  the  effect  of 
shortening  the  moment  arm  and  reduced  the  noise  in  this  path.  Minor  hardware  changes 
arc  also  being  made  to  provide  isolation  in  the  accelerometer  electronics.  These 
filter  changes  required  the  modifications  to  the  flight  control  system  described 
below.  In  addition,  these  changes  significantly  increased  the  computational  burden 
to  near  the  processor  limit.  Any  future  design  should  attempt  to  minimize  MRU 
separation  in  excess  of  that  required  survivability  as  well  as  allow  sufficient 
processor  sizing.  Another  solution  that  may  be  available  to  future  systems  is  the 
selection  of  a  redundancy  management  system  that  is  less  sensitive  to  noise.  This  is 
a  difficult  goal  to  achieve  since  the  sensor  reconfiguration  must  be  done  quickly 
enough  to  prevent  transients  in  the  flight  control  outputs.  Some  form  of  weighted 
averaging  may  allow  a  longer  time  period  for  decision  making.  These  problems, 
solutions,  and  recommendations  are  summarized  in  Figure  8. 

3.2  FLIGHT  CONTROL  TEST  RESULTS 

The  first  major  flight  control  test  was  a  man -in -the -loop  simulation.  The  conclusion 
of  this  testing  was  that  the  system  was  stable  and  controllable  for  all  maneuvers. 
However,  during  small  amplitude  stick  raps  and  rudder  kicks,  the  MFCRS  system  was 
slightly  less  damped  than  the  basic  F-1S,  requiring  an  extra  half  cycle  of 
oscillation  to  damp.  This  decrease  in  damping  was  traced  to  the  3  db  lag-lead 
network.  To  Increase  the  damping  and  maintain  desired  stability,  this  filter  was 
replaced  with  a  3  db,  second  order,  lead-lag  network.  While  this  network  was  adequate 
to  maintain  stability  and  performance,  analysis  indicated  that  performance  would  be 
better  if  a  computation  rate  between  80  and  100  hertz  was  used.  This  would  allow  a 
sharper  roll  oft  on  the  filters.  The  use  of  existing  hardware  with  limited  processing 
capability  denied  this  option  to  the  MFCRS  program.  However,  performing  flight 
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control  at  50  hertz  with  an  existing  processor  will  demonstrate  this  technology  is 
feasible  on  current  processors. 

This  modified  implementation  was  given  to  Honeywell  to  code  into  the  MRU  processor. 

The  same  test  case  methodology  described  for  the  redundancy  management  was  used  in 
testing  and  verifying  the  flight  code  for  the  flight  control  modules.  The  development 
of  the  flight  control  software  was  complicated  at  this  point  by  the  filtering  require¬ 
ments  discovered  during  the  redundancy  management  testing  discussed  above.  One  of 
the  results  was  the  addition  of  a  . 1  second  first  order  lag  filter  on  the  accelera¬ 
tion  feedback  paths.  To  maintain  stability,  the  gain  in  the  pitch  and  yaw  control 
loop  had  to  be  scheduled  based  on  dynamic  pressure.  Analysis  also  showed  the  5  db 
lead-lag  network  provided  some  gain  of  the  accelerometer  noise.  The  use  of  gain 
scheduling  allowed  elimination  of  this  network.  To  verify  stability  and  performance 
after  these  changes,  another  man-in-the-loop  simulation  was  conducted.  The  results 
indicated  that  this  approach  will  provide  acceptable  performance  and  stability. 

These  changes  illustrate  the  difficulty  of  integrating  multifunction  sensors  with 
existing  systems.  Multifunction  systems  should  not  be  Inserted  directly  into  current 
flight  control  svstems  simply  as  a  sensor  replacement.  The  multifunction  system  is 
part  of  the  flight  control  loop  and,  to  derive  maximum  benefit,  the  Implications  of 
the  sensors  should  be  considered  in  the  complete  flight  control  design.  The  MFCRS 
was  constrained  from  modifying  the  flight  control  hardware  so  the  flight  control 
system  could  remain  compatible  with  the  existing  flight  sensors.  This  constraint 
should  be  removed  in  the  design  of  a  prototype  system. 

3.3  IHTECRATIOH  VS  INTERFACING 

Taken  together,  the  above  flight  control  and  redundancy  management  problems  point  to 
a  fundamental  problem  in  the  design  of  Integrated  systems.  The  navigation  units 
currently  available  for  the  MFCRS  test  demonstration  were  designed  by  navigation 
specialists  who  did  not  have  any  flight  control  requirements  Imposed  upon  them  at 
that  time.  The  flight  control  specialists  who  made  the  initial  design  modifications 
to  the  MRU's  were  not  fully  aware  of  some  of  the  assumptions  made  in  the  basic 
navigation  design.  Currently,  systems  are  designed  for  specific  purposes  and  are 
made  to  Interface  with  other  systems.  True  integration,  as  shown  by  this  program,  is 
more  difficult.  As  the  integration  of  fire  control,  flight  control,  and  propulsion 
control  continues,  similar  problems  are  expected.  In  order  to  minimize  integration 
problems  and  to  take  advantage  of  complementary  capabilities,  future  programs  need  to 
t>e  strongly  Influenced  by  a  systems  integration  group.  The  objective  of  this  group 
is  to  Interact  with  engineers  that  are  specialists  in  all  of  the  systems  being 
Integrated  in  order  to  find  and  resolve  conflicting  requirements  early  in  the  design 
stage.  To  carry  out  this  function,  excellent  communication  must  exist  between  the 
organizational  elements  responsible  for  flight  control,  fire  control,  and  propulsion 
control,  and  the  coordinated  effort  must  be  responsive  to  the  Influence  exerted  by 
the  multifunction  integration  group.  Project  organization  must  facilitate  these 
requirements  for  communication  and  coordination. 

The  foregoing  problems,  short-term  solutions,  and  long-term  racomendations  are 
aumarlzed  in  Figure  9. 
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4.  FUTURE  PLANS 

The  testing  In  the  MFCRS  program  has  been  Instrumental  in  identifying  problem  areas 
and  design  considerations  for  future  systems.  However,  there  are  still  questions 
that  cannot  be  answered  by  laboratory  testing.  The  MFCRS  system  will  be  flown  in  an 
F-15  testbed  in  late  1983  to  evaluate  aircraft  stability  and  handling  qualities, 
fault  coverage,  reconfiguration  transients,  navigation  performance,  and  reliability. 
This  flight  test  is  not  meant  to  be  an  exhaustive  evaluation  of  a  new  system  but  will 
focus  on  two  key  areas:  flight  control  and  redundancy  management  performance. 

Stability  and  handling  qualities  evaluations  will  answer  the  question  of  how  well 
separated  sensors  at  non-optimal  locations  can  be  used  for  fighter  flight  control. 

Fault  coverage  and  reconfiguration  transient  evaluations  will  hinge  on  how  well  the 
effects  of  structural  bending  and  differential  vibration  have  been  modeled  and  com¬ 
pensated  for  in  the  redundancy  management  algorithm.  The  program  schedule  in  Figure  10 
shows  the  tasks  that  have  been  accomplished  to  this  point  and  those  remaining, 
including  aircraft  Integration  and  flight  test. 
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5 .  CONCLUSIONS 

The  Multifunction  Flight  Control  Reference  System  concept  addresses  the  problems  of 
current  systems  that  require  inertial  data  and  provides  for  the  needs  of  future 
systems.  The  MFCRS  program  uses  existing  hardware  to  demonstrate  the  concept  in  a 
cost  effective  manner. 

A  redundancy  management  system  using  parity  equations  has  been  developed  for  the 
separated  sensors.  One  key  aspect  of  the  redundancy  management  Is  the  use  of  an 
off-line  program  to  relate  parity  equation  status  to  the  most  likely  failed  sensors. 
This  off-line  program  reduces  the  real-time  processing  requirements  to  allow  use  of 
an  existing  processor.  To  support  the  redundancy  management  system,  a  one  time 
electronic  alignment  procedure  has  been  developed  and  implemented  to  determine  the 
relative  orientation  of  the  two  sensor  clusters  to  within  ±1.5  arcminutes.  This 
electronic  alignment  procedure  is  faster,  cheaper,  and  more  accurate  than  current 
optical/mechanical  boresighting  procedures  and  has  potential  for  application  in  other 
programs . 

Flight  control  and  redundancy  management  compensation  has  been  developed,  implemented 
and  simulated  for  a  worst  case  sensor  separation.  The  software  for  the  redundancy 
management  and  flight  control  was  successfully  developed  and  coded.  A  key  to  the 
successful  software  development  was  the  use  of  a  test  case  to  validate  the  original 
code  and  all  subsequent  changes. 

The  results  of  testing  have  shown  that  noise  caused  by  RLG  dither  is  a  severe  problem 
for  flight  control  redundancy  management.  Noise  attenuation  should  be  addressed  in 
the  basic  system  design.  Testing  has  also  shown  that  a  multifunction  system  must  be 
considered  as  part  of  the  flight  control  loop  and  the  overall  flight  control  system 
design  must  consider  issues  peculiar  to  the  multifunction  system. 

The  suggested  management  technique  to  design  future  Integrated  systems  will  be  to  use 
a  strong  systems  integration  group  to  Interact  with  and  be  part  of  the  design  team. 

Future  testing  on  an  F-15  aircraft  will  provide  data  so  the  key  areas  of  flight 
control  and  redundancy  management  performance  can  be  evaluated. 

The  design,  development,  and  testing  of  the  MFCRS  to  date  has  not  shown  any  basic 
flaws  with  the  multifunction  concept,  but  has  provided  valuable  insights  for  future 
designs  of  integrated  systems. 
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SOME  ASPECTS  OF  FLIGHT  TRAJECTORY  CONTROL  XN  FUTURE  AVIONIC  SYSTEMS 
FOR  COMBAT  AIRCRAFT 

by  W.H.  McKinlay,  Ferranti  pic.  Ferry  Road,  Edinburgh  EHS  2XS,  Scotland. 


- ^This  paper  considers  some  of  the  reasons  for  Increased  Int¬ 
egration  with  the  emphasis  on  Flight  Profile  Control  in  combat 
aircraft,  largely  in  the  ground  attack  role.  Waving  examined 

4ome  of  the  reasons  for  further  integration  involving  flight  control 
looks  at  the  various  phases  of  flight  and  highlights  particular 
-  problems  to  be  considered.  Having  suggested  trends  or  solutions 
in  the  more  important  specific  areas^the  paper  suggests  that  future 
work  will  consist  of  developing  particular  capabilities,  concentrat¬ 
ing  on  the  relationship  between  pilot  and  total  system,  learning 
how  to  control  the  design  of  such  a  closely  coupled  system  and 
handling  the  important  problems  of  testing,  reliability,  maintain¬ 
ability  and  the  attainment  of  minimum  economic  configurations  which 
will  satisfy  all  these  goals.  The  need  for  flexibility  in  any 
system  which  combines  automation  with  a  high  degree  of  pilot  part¬ 
icipation  is  stressed. 
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1.  INTRODUCTION 

For  some  years  the  design  of  avionic  systems  for  combat  aircraft  has  been  subject 
to  a  number  of  pressures  which  have  not  always  been  compatible.  The  need  for  surviv¬ 
ability  in  an  increasingly  hostile  environment  drives  such  operations  towards  flight  at 
very  low  altitudes  which  in  turn  tends  to  raise  the  pilot's  workload  and  minimise  the 
extent  to  which  he  can  operate  head-down.  At  the  same  time  a  drive  to  operate  at  night 
and  in  low  visibilities  involves  the  carriage  of  more  sophisticated  forward  looking 
sensors  such  as  enhanced  radars  and  electro-optical  systems  which,  in  their  initial  form, 
require  considerable  pilot  interpretation.  Future  dispenser  or  guided  weapons  for  use 
against  vehicles  or  tanks  should  be  highly  effective  if  launched  appropriately  in  con¬ 
junction  with  sensors,  but  this  could  complicate  the  pilot's  task  in  weapon  delivery. 

All  these  trends  Indicate  the  need  to  reduce  pilot  workload  by  using  automation 
while  at  the  same  time  improving  the  accuracy  with  which  the  desired  flight  profile  is 
flown.  While  past  standards  of  navigation  have  been  adequate  as  regards  position  find¬ 
ing  there  is  a  need  for  improved  path  keeping  and  conceivably  for  an  improvement  in 
basic  accuracy,  both  of  which  increase  the  interest  in  flight  automation. 

There  is  also  considerable  scope  for  the  application  of  automation  to  the  aircraft 
itself  for  ACT  to  provide  higher  efficiency  and  better  handling,  and  to  the  handling 
and  monitoring  of  the  basic  aircraft  systems.  With  so  many  possibilities  it  is  impor¬ 
tant  to  achieve  a  picture  of  the  balance  which  is  being  sought  and  also  to  use  integra¬ 
tion  as  a  tool  to  reduce  overall  complexity  and  increase  testability  while  reducing  cost 
of  ownership. 

2.  REASONS  FOR  C POSER  SYSTEM  INTEGRATION 

The  development  of  computers  and  better  means  of  data  transmission  including  the 
data  bus  have  opened  the  way  to  further  integration  provided  that  the  basic  disciplines 
of  system  design  are  observed.  It  is  however  important  not  to  pursue  integration  for 
its  own  sake  but  to  ensure  that  any  integrated  system  is  designed  around  a  coherent 
philosophy. 

Generally  integration  can  be  pursued  for  reasons  conneoted  with  system  design  and 
management  or  operational  reasons. 

The  design  reaaons  are  largely  concerned  with  economy:  there  is  an  optimum  way  of 
combining  sensors,  displays,  automatic  controls  and  computing  facilities  to  achieve  a 
given  operational  capability  with  a  given  degree  of  redundancy  which  must  be  justified. 

It  is  possible  to  trade  off  availability  against  the  rate  at  which  faults  will  arise  and 
have  to  be  corrected.  While  the  massive  amount  of  data  which  can  be  interchanged  in 
modern  bus  systems  has  increased  the  number  of  solutions  available  for  testing  and  fault 
diagnosis,  some  configurations  will  still  be  more  maintainable  than  others.  However, 
in  high  performance  military  coxbat  aircraft  it  is  much  more  likely  that  the  first  driver 
towards  integration  will  be  operational. 

The  areas  in  which  operational  Integration  can  be  used  to  solve  problems  can  be 
distinguished  as  below.  In  each  case  the  design  objectives  will  be  slightly  different, 
reflecting  a  different  emphasis  on  such  aspects  as  performance ,  safety,  pilot  accept¬ 
ability,  etc. 

Automation  nay  be  used  to  off-load  the  pilot  by  simply  taking  over  tasks  which  are 
better  performed  thus  without  being  changed  in  nature.  Simple  auto  pilot  facilities 


13-2 


such  as  height  holding  or  following  radio  aids  are  in  this  category  but  there  may  also  be 
highly  sophisticated  tasks  such  as  automating  target  recognition  through  E-0  sensors. 

One  advantage  of  this  approach  is  that  relatively  pieae-meal  automation  can  be  carried 
out  without  necessarily  changing  the  pilot's  task  in  its  essentials.  Similarly  the 
safety  philosophy  need  not  change. 

In  some  cases  automation  may  actually  do  a  better  job  than  the  pilot  in  terms  of 
performance;  e.g.  flying  a  complex  flight  trajectory  which  might  not  easily  be  flown 
manually  with  sufficient  accuracy. 

There  is  a  sound  operational  case  for  any  application  of  automation  which  can  in¬ 
crease  survivability,  such  as  any  system  of  automatic  terrain  following  or  avoidance 
which  permits  very  low  flight  in  all  weathers. 

Once  the  concept  of  increased  automation  of  flight  path  control  is  accepted  it 
becomes  possible  to  consider  its  exploitation  in  changing  the  shape  of  a  mission  or  even 
by  developing  new  kinds  of  weapon  or  tactics  which  could  not  be  used  otherwise. 

At  one  time  there  was  an  explosive  growth  in  the  application  of  automatic  flight 
control  to  civil  transport  aircraft,  culminating  in  the  adoption  of  automatic  landing 
down  to  Cat.  3  conditions  in  which,  at  the  time,  it  was  considered  human  pilots  would 
never  be  able  to  operate  safely.  Such  systems,  designed  on  the  basis  thnt  an  automatic 
solution  could  be  made  to  work,  were  sometimes  called  "ultra-human  systems".  Subsequent¬ 
ly  it  was  found  that  an  appropriate  mix  of  human  pilot  and  automatic  or  instrumental 
assistance  could  do  the  job  more  economically,  but  the  idea  that  there  are  valid  system 
concepts  depending  entirely  on  the  use  of  automatics  seems  to  have  been  accepted  together 
with  the  resulting  complexity,  e.g.  active  control.  A  solution  which  hinges  success  on 
automatics  and  their  relationship  with  the  pilot  implies  a  complete  commitment  and  there¬ 
fore  formidable  design  problems,  including  those  concerned  with  safety. 

3.  INTEGRATION  IN  SINGLE  SEAT  COMBAT  AIRCPAFT 

3.1  General 


While  the  integration  of  fire  control/weapon  delivery  functions  and  flight 
control  is  the  primary  topic  of  this  Symposium  it  is  necessary  to  see  the  operation 
of  a  combat  aircraft  in  the  context  of  all  the  relevant  phases  of  flight.  It  will 
be  necessary  to  make  translations  between  phases  both  smooth  and  logical  and  an 
integrated  approach  also  demands  that  wherever  such  facilities  are  Included  for  a 
particular  purpose  they  should  also  be  used  to  optimise  the  operation  wherever 
possible . 

3.2  Transit  to  Target 

Here  the  flight  trajectory  is  essentially  concerned  with  navigation,  normally 
in  two  dimensions  tut  in  three  if  it  is  expanded  to  include  selecting  a  vertical 
profile  which  is  the  beat  compromise  between  achieving  masking  from  defences  and 
avoiding  the  ground.  The  general  pressure  is  to  fly  at  increasingly  low  altitudes. 

There  are  of  course  extremely  sophisticated  single  or  two  seat  aircraft  which 
contain  a  complex  equipment  fit  aimed  at  both  these  objectives  and  at  day/nlght 
operations.  But  to  consider  the  Bystem  integration  problem  it  is  better  to  start 
with  a  relatively  simple  single  seat  aircraft  in  which  the  exercise  is  a  combination 
of  computers,  displays  and  pilot's  eye.  An  inertial  navigator  with  a  corresponding 
guidance  facility  can  be  programmed  to  steer  a  horizontal  track  through  a  series  of 
pre-planned  waypoints.  The  control  loop  is  completed  through  the  Head  Up  Display 
(HUD) .  Pilots  are  skilled  at  both  adjusting  their  altitude  by  looking  ahead  by 
day  and  making  small  horizontal  adjustments  to  take  advantage  of  the  terrain.  A 
primary  objective  is  survivability  and  at  present  this  can  be  increased  in  several 
ways  apart  from  flying  lower.  It  is  a  valid  function  of  automation  to  reduce 
workload  by  remotlng  a  task  in  time.  Modem  briefing  systems  (Fig.  1.)  can  store 
large  amounts  of  data  about  optimum  flight  paths  and  enemy  defences  so  that  the 
planned  trajectory  can  be  more  sophisticated,  reflecting  the  best  available  know¬ 
ledge,  and  being  loaded  into  the  aircraft's  computer  before  take-off. 

In  handling  the  horizontal  profile  there  is  a  choice  between  reinforcing  the 
pilot's  eye,  adding  an  extremely  sophisticated  sensor  or  moving  towards  some  sort 
of  planned  horizontal  navigation.  Various  night  vision  devices  or  FLIR,  perhaps 
displayed  on  the  HUD,  all  tend  to  reinforce  the  pilot's  eye  solution  but  whether 
they  are  adequate  seems  to  depend  on  whether  flight  at  much  lower  altitudes  is 
contemplated.  The  freedom  to  manoeuvre  which  one  would  expect  most  pilots  to  like 
Implies  that  blind  flying  through  a  sensor  must  Include  the  capability  to  turn  on 
an  instlct  to  do  so,  in  which  case  the  sensor  must  acquire  information  as  to  what 
is  "round  the  corner"  instantly  and  determine  the  best  profile.  Such  a  radar  cap¬ 
ability  was  demonstrated  by  Ferranti  some  twenty  years  ago  and  highly  effective 
systems  have  been  produced  since,  but  they  are  expensive.  Radar  and  Electro- 
Optical  systems  compete  for  the  same  real  estate  around  the  nose  of  the  aircraft 
and  the  system  integration  approach  implies  attention  to  other  possibilities. 

A  theoretical  possibility  is  that  an  ideal  navigation  solution  can  be  post¬ 
ulated  in  which  there  is  a  digital  database  representing  the  terrain  which,  coupled 
with  very  accurate  navigation,  enables  the  generation  of  control  Inputs  for  auto- 
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Katie  or  manual  flight  at  very  low  altitudes.  Other  possibilities  include  a 
more  realistic  reinforcing  of  such  a  system  with  forward  sensors  which  could 
particularly  handle  the  "round  the  comer"  problem. 

Whatever  solution  is  adopted  it  is  most  attractive  to  try  to  off-load  workload 
through  automatics  in  transit  so  as  to  enable  the  pilot  to  pay  more  attention  to  the 
tactical  situation,  enemy  defences  and  the  operation  of  his  own  counter  measures. 
Clearly  any  system  Involving  full  automatic  control  at  very  l'j  altitudes  could  tend 
to  be  "ultra-human"  which  would  mean  some  degree  of  dual  or  triple  redundancy,  which 
might  be  analytical  in  terms  of  sensors  but  could  not  be  in  terms  of  control.  It 
is  attractive  to  consider  a  mixed  manual /automatic  solution  of  which  there  are 
obviously  many  possibilities  including: 

Fully  automatic  control  of  ground  clearance  at  some  altitude  safe 
for  the  system  with  manual  control  of  heading  changes  through  bank 
to  vary  the  horizontal  profile. 

Something  similar  but  "transparent"  to  enable  the  pilot  to  overpower 
the  system  without  disengaging  it  so  as  to  go  to  a  lower  altitude  or 
turn  off. 

Some  fort:  of  blending,  more  like  an  auto-stabiliser,  with  pilot  and 
automatic  inputs  in  parallel,  the  latter  overpowering  the  former  in 
the  event  of  a  hazard,  with  some  suitable  warning  as  to  why. 

This  implies  a  system,  rather  like  an  ACT  system  with  limitation  within  a  given 
flight  envelope,  the  envelope  in  this  case  including  the  ground.  It  does  seem 
that  a  fully  automatic  system  would  be  unacceptable,  apart  from  its  complexity, 
because  of  the  discontinuity  when  the  pilot  had  to  reject  it  in  order  to  carry  out 
a  perfectly  normal  manoeuvre.  The  system  could  never  be  programmed  for  all 
"normal"  manoeuvres.  It  also  seems  that  the  final  solution  will  have  to  behave 
"naturally"  as  seen  by  pilots  rather  than  as  seen  by  designers.  But  certainly 
the  sensors  (inertial,  radio  altimetry  and  possibly  radar  or  laser)  and  the  data¬ 
base  or  mixing  techniques  required  to  implement  the  variety  of  solutions  are 
available. 

It  is  also  possible  that  future  systems  will  integrate  rather  more  data  about  the 
position  of  defences,  threats,  etc.  and  if  this  data  could  be  changed  in  the  air 
from  intelligence  which  was  not  stale  safe  changes  in  trajectory  could  be  generated 
for  presentation  to  the  pilot.  They  could  be  fed  into  an  "advisory"  type  of  con¬ 
trol  system  as  described  above.  But  in  this  case,  expecting  a  "natural"  response, 
the  pilot  would  also  have  to  have  a  suitable  diBplay  saying  why  the  system  wanted 
to  adjust  the  profile.  Present  electronic  display  technologies  (Fig.  2.)  provide 
the  means  to  do  this  but  the  available  content  may  have  to  be  limited. 

3.3  Ground  Attack 


Papers  on  the  IFFC  system  (ref.  1.)  make  some  good  points  about  the  ad¬ 
vantages  of  a  partially  automatic  trajectory  solution  in  ground  attack.  The  most 
notable  is  that  weapon  release  In  a  curved  trajectory  makes  life  more  difficult 
for  the  defences,  and  this  advantage  can  be  considered  in  the  context  of  a  typical 
attack. 

The  most  difficult  form  of  attack  i«  likely  to  be  against  armoured  formations 
of  which  the  precise  location  and  distribution  is  e  little  uncertain.  Weapons 
tailored  specifically  for  this  task  will  have  to  be  released  in  such  a  way  as  to 
match  the  release  point,  the  weapon  characteristics  and  the  array  of  vehicles  in 
as  optimum  a  manner  as  is  possible  in  a  very  short  time.  In  some  cases  a  pop-up 
manoeuvre  will  be  employed.  In  all  cases  the  pilot  workload  will  be  high, 
particularly  If  he  has  to  interact  with  his  E-0  sensors  before  and  after  target 
acquisition.  One  would  expect  it  to  be  possible  to  relieve  this  load  partially 
by  a  degree  of  automatic  flight  trajectory  control,  say  by  flying  a  planned  curved 
trajectory  which  also  increases  survivability.  However  there  could  be  problems 
In  this  area.  For  example  if  the  location  of  the  target  it  not  known  with  suffi¬ 
cient  precision  the  pilot  will  find  himself  making  final  corrections  in  a  curve 
rather  than  in  straight  flight,  with  a  consequent  effect  on  the  utility  of  the  HDD. 

It  does  seem  that  in  weapon  delivery  the  greatest  advantage  of  a  degree  of 
automatic  control  is  in  terms  of  accuracy  and  rapid  settling  of  aladng  provided 
that  the  necessary  aiming  information  is  available.  One  would  expect  the  technique 
to  function  better  in  air-to-air  situations  than  in  badly  structured  ground  attacks 
requiring  a  considerable  amount  of  last  minute  decision  making. 

3.4  Alr-to-Alr  Combat 

It  is  instructive  to  examine  the  possibility  of  improving  air  combat  effect¬ 
iveness  if  flight  and  fire  control  are  Integrated.  In  particular  the  head-on 
approach  is  of  interest  in  an  air  superiority  aircraft  as  is  the  role  of  this  tech¬ 
nology  In  front  hesilsphere  attacks.  Here  the  problems  of  weapon  aiming  are 
particularly  exacting,  being  accentuated  by  high  range  rates,  line  of  aight  rates 
and  line  of  sight  accelsrationa. 
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In  the  past  the  preferred  interception  weapon  has  been  the  guided  missile , 
when  optimised  for  this  type  of  attack.  However  air-to-air  guns  can  show  distinct 
advantages  in  terms  of  reduced  weight#  reduced  profile  drag#  expense  and  the  ability 
to  carry  a  large  number  of  projectiles.  Weight  and  drag  shorten  mission  times 
through  an  attendant  fuel  penalty. 

For  guns  to  be  effective  in  this  mode  of  attack  it  is  necessary  to  understand 
the  effects  of  target  acceleration  and  its  measurement  and  the  likely  order  of 
magnitude  of  the  variables  involved  before  the  necessary  improvements  in  weapon  aim¬ 
ing  computation  can  be  made.  The  pilot's  task  must  then  be  considered,  particularly 
in  terms  of  target  acquisition,  tracking  and  ability  to  handle  the  system  within 
whatever  firing  opportunity  emerges.  It  should  be  possible  to  enhance  tracking  by 
an  integration  of  fire  and  flight  control  including  some  suitable  assignment  of 
tasks  to  pilot  and  automatics. 

The  simulation  upon  which  this  part  of  the  paper  is  based  was  originally 
undertaken  to  examine  the  dynamics  of  such  attacks  as  part  of  more  comprehensive 
studies  aimed  at  the  definition  of  future  airborne  radars.  The  first  part,  which 
is  reported  here#  dealt  with  the  simulation  and  investigation  of  typical  approaches. 

The  simulation  results  shown  in  Figs.  3-7  show  the  paths  followed  by  the 
attacking  aircraft  and  its  quarry  and  use  the  following  assumptions: 

At  time  zero  the  fighter  will  have  position  co-ordinates  (0,  0)  and 
velocity  of  500  ft/second  in  unspecified  direction. 

The  target' 8  flight  is  parallel  to  the  Y-axis  prior  to  acceleration, 
target  acceleration  being  applied  smoothly  over  a  one  second  interval. 

Corilis  and  gravitational  forces  are  neglected  as  being  trivial  or 
not  significant  in  the  present  simulation. 

Bullet  velocity  is  approximated  with  a  single  value. 

The  target  position,  velocity  and  acceleration  are  known  exactly  at 
any  given  instant. 

The  cases  considered  include  the  following: 

Fig.  3:  Target  flies  straight  with  an  initial  offset  of  500  ft. 

Fig.  4:  The  target  applies  an  acceleration  of  8-G  after  flying 

straight  for  about  2.3  seconds  or,  in  Fig.  5,  an  accel¬ 
eration  in  the  opposite  direction. 

In  Fig.  6  the  target  applies  acceleration  about  1.3  seconds  earlier 
while  in  Fig.  7  it  has  a  large  offset  (2,900  feet)  and  flies  straight 
at  all  times. 

It  will  be  seen  that  firing  opportunities  are  normally  around  4  seconds 
although  in  Fig.  6  the  opportunity  is  increased  to  some  undetermined  large  value; 
neglecting  target  acceleration  and  assuming  straight  flight  the  rate  of  increase 
of  fighter  acceleration  to  maintain  lead  angle  is  a  function  of  offset.  Accel¬ 
eration  either  towards  or  away  from  the  fighter  flight  path  has  little  effect  in 
direction  but  acceleration  towards  the  fighter  causes  a  marginal  reduction  in 
firing  opportunity. 

A  detailed  scrutiny  of  the  results  shows  some  general  characteristics  of 
such  an  attack.  A  firing  opportunity  is  taken  to  involve  a  time  of  flight  of 
less  than  1.5  seconds  and  a  fighter  turning  acceleration  of  less  than  8-G.  In 
most  cases  firing  opportunities  last  for  around  4  seconds.  Over  the  first  2 
seconds  modest  turning  accelerations  of  less  than  1-G  appear  but  in  the  latter  part 
of  a  firing  opportunity,  at  shorter  ranges,  a  very  fast  wind-up  into  the  turn,  say 
2.5-G/second,  can  be  encountered. 

■*  Considering  the  pilot's  task  as  a  whole  when  encountering  a  threat  justifying 

a  front  sector  attack: 

t  The  threat  will  be  detected  on  radar  say  30  seconds  before  the  firing 

opportunity  appears  and  this  is  the  time  available  to  preoare  a  response. 

From  5,000  feet  in  everything  will  be  over  in  under  5  seconds  and 
although  the  demanded  turn  rates  will  be  modest  for  the  first  2 
seconds  of  the  firing  opportunity  they  will  wind  up  rapidly  in  the 
last  2  seconds. 

Ir  this  rapid  sequence  of  events  the  aircraft  will  have  to  be  flown 
extremely  accurately  in  response  to  weapon  delivery  information. 

The  problem  will  be  exacerbated  in  turbulence  and  the  nilot  may  be 
Interrupted  by  other  factors  such  as  BW  or  communications. 
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It  follows  that  integration  with  flight  control  should  be  used  to  reduce 
the  pilot  load  as  much  as  possible.  Where  flight  control  commands  are 
blended,  presumably  pilot  tracking  of  the  required  profile#  a  major 
load  even  without  striving  for  accuracy,  can  be  substantiated  by  flying 
automatic  tracking  with  which  automatic  firing  armed  by  the  pilot  could 
be  used. 

In  this  case  it  does  appear  that  as  much  flight  control  authority  as  is 
possible  could  be  used  with  advantage  provided  the  pilot  were  free  to  over-ride 
it  instantaneously#  for  example,  to  break  off  the  attack  for  some  unforeseen  reason 
e.g.  the  target  no  longer  exists.  In  any  event  an  immediate  reversion  to  full 
manual  control  will  be  necessary  to  enter  a  break-away  manoeuvre  which  is  entirely 
impossible  to  predict  in  terms  of  the  demands  which  would  be  required  of  the 
automatics . 

The  most  important  impression  gained  from  this  example  is  that  a  most  useful 
manoeuvre,  the  front-hemisphere  attack,  is  extremely  demanding  in  terms  of  time 
apart  from  accuracy  and  the  ability  to  make  such  attacks  possible  will  be  a  major 
attraction  in  considering  integrated  fire-flight  control. 

4 .  FUTURE  PROBLEMS 


There  are  strong  intuitive  reasons  to  feel  that  pilots  of  single  seat  aircraft 
should  have  the  routine  task  of  flying  the  aircraft  off-loaded  as  much  as  possible  just  as 
their  handling  of  other  aircraft  systems  and  the  interpretation  of  complex  data  from  EW  or 
communication  sources  should  be  automated  before  display.  But  it  also  seems  clear  that 
a  major  problem  is  to  decide  what  is  worth  doing,  or  perhaps  what  not  to  do,  as  the  tech¬ 
nology  is  so  powerful.  Clearly  future  work  should  concentrate  on  the  pilot  relations  and 
on  the  best  way  of  developing  total  system  design  concepts  which  can  be  validated  in  terms 
of  human  factors  as  well  as  technically. 

At  the  same  time,  with  the  advent  of  more  complex  avionics  and  weapons,  the  designers 
aim  should  be  to  over-kill  the  workload  problem  as  otherwise  pilots  will  find  it  difficult 
to  handle  the  resulting  complex  systems,  particularly  under  stress. 

It  is  an  interesting  coincidence  that  the  relationship  between  pilot  and  system  and 
between  designers  and  design  aids  follows  the  same  pattern.  At  the  highest  level  of  ab¬ 
straction  the  pilot  is  concerned  with  tactics  and  flexibility  and  at  the  lowest  with  hand¬ 
ling  equipments  and  carrying  out  optimal  manoeuvres.  A  corresponding  split  of  respons¬ 
ibility  between  pilot  and  avionics  is  dictated.  In  design,  at  the  conceptual  level,  the 
problems  are  multi-dimensional  and  require  an  interaction  between  designers  and  operators. 

The  act  of  automation  is  essentially  to  displace  a  problem  in  time,  in  space  or 
both.  A  highly  automated  approach  to  the  problems  of  combat  aircraft  makes  the  assumption 
that,  many  years  ahead,  pilots  and  system  designers  sitting  in  conference  rooms  or  labor¬ 
atories  can  actually  solve  problems  which  will  occur  yeart  later  in  the  heat  of  a  battlefield 
It  seems  best  to  assume  that  as  this  cannot  succeed  completely  the  quest  is  one  for  flex¬ 
ibility. 

5.  CONCLUSION 


The  paper  has  reviewed  some  aspects  of  automation  and  therefore  the  integration  of 
flight  control  with  other  functions  in  combat  aircraft. 

It  has  been  pointed  out  that  the  critical  area  is  between  pilot  and  aircraft  system 
and  that  even  the  most  successful  Interaction  between  operators  and  designers  would  prob¬ 
ably  produce  a  solution  which  was  not  entirely  valid  in  a  battlefield.  At  the  same  time 
it  is  vital  to  reduce  pilot  workload. 

In  detail  it  has  been  suggested  that  some  form  of  advisory  automatic  control  coupled 
with  displays  should  be  used  to  vary  horizontal  navigation  for  survivability  and  that  in 
the  vertical  the  approach  is  nearer  to  a  form  of  flight  envelope  limitation  which  includes 
the  ground. 

In  terms  of  weapon  delivery  it  seems  that  the  introduction  of  a  degree  of  automatic 
flight  path  control  will  pay  off  most  in  cases  in  which  an  improvement  in  aiming  would  be 
beneficial  coupled  with  a  more  rapid  settling  to  a  stable  solution.  In  ground  attack 
where  target  positions  and  distributions  are  uncertain  the  problem  is  more  difficult  and 
requires  further  investigation  which  will  have  to  involve  topics  concerned  with  targets 
and  weapon  design  which  are  outside  the  scope  of  this  paper. 

In  air-to-air  combat  improved  sensors  and  fire  control  computers  have  the  potential 
to  make  weapons  more  effective  provided  that  the  necessary  aiming  accuracy  can  be  achieved, 
possibly  in  turning  flight  and  where  events  occur  very  rapidly.  This  indicates  a  favour¬ 
able  direction  in  which  to  apply  the  integration  of  flight  and  fire  control  and  the  paper 
has  shown,  that  for  example,  front  hemisphere  attacks  using  guns  would  certainly  fall 
within  this  category.  At  the  same  time  just  as  automatic  and  manual  control  may  be  blended 
to  carry  out  difficult  manoeuvres,  the  different  phases  of  an  operation  will  have  to  blend 
smoothly  into  one  another.  In  air-to-air  attacks  it  is  important  to  get  the  approach 
right  while  at  the  same  time  the  system  must  cater  for  quite  abrupt  discontinuities  when 
the  pilot  has  to  abandon  a  programme  manoeuvre  and  take  improvised  action  drawing  on  all 
his  tactical  and  flying  skills.  On  the  whole  the  past  history  of  automatic  flight  control 
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has  been  more  successful  in  terms  of  flight  profile  control  itself  than  in  handling  pilot 
interactions  and  changes  of  mode  or  Sector,  particularly  when  the  operation  has  to  go  off- 
programme  . 

It  therefore  seems  that  there  should  be  several  broad  thrusts  in  the  development  of 
integrated  fire- flight  control. 

Future  operations  and  tactics  should  be  studied  carefully  to  determine  precisely 
how  such  improvements  could  be  beneficial;  e.g.  in  attaching  ground  targets  will  their 
position  be  known  and  if  not  what  problem  will  confront  the  pilot? 

Practical  system  development  such  as  that  already  underway  is  required  to  determine 
optimum  flight  profiles  and  control  techniques. 

It  will  be  necessary  to  establish  whether  these  new  possibilities  can  be  realised 
with  present  sensors  or  whether  the  sensors  themselves  require  modification  or  upgrading 
in  performance. 

The  resulting  combinations  of  sensors,  automatics  and  systems  should  be  exploited 
as  much  as  possible  in  all  phases  of  flight  and  a  major  effort  will  be  required  in  the 
context  of  a  particular  system  design  to  determine  precisely  how  it  will  handle  all  oper¬ 
ational  eventualities,  particularly  those  which  cannot  be  foreseen  easily  but  may  result 
from  unexpected  circumstances. 

Finally,  having  determined  a  new  relationship  between  pilot  and  automatics,  it  will 
be  necessary  to  ask  whether  this  has  particular  effects  on  display  and  control  requirements. 

The  author  is  grateful  to  the  Management  of  Ferranti  pic  for  permission  to  publish 
this  paper  and  to  his  colleagues  within  Ferranti  and  elsewhere  in  the  UK  for  stimulating 
the  ideas  contained  in  it. 


Reference  1;  Integrated  Flight  and  Fire  Control  Development  and  Flight  Test  on  an  F.15B 
Aircraft;  Sims,  Hillman,  Kocher  and  Green  HAECON  May  1982  and  other 
related  papers. 
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SUMMARY  -*  tfi'f U '•  ' 

7?  A  diagnosis  scheme  for  sensors  of  a  flight  control  system  is  presented. ^JTased  on  ana¬ 
lytic  redundances  duplex  settsur  configuration  provides  the  fail-operational  capability 
of  a  conventional  triplex  sensor  system.  This  is  achieved  by  using  deterministic  observers. 
The  feasibility  of  the  presented  concept  is  demonstrated  by  flight  test  results. 

1 .  INTRODUCTION  -< 

Reliability  plays  a  vital  role  in  flight  control  systems  of  today  and  in  those  of  the 
future.  Particularly  the  most  attractive  control  concepts  such  as  artificial  stability 
for  the  enhancement  of  maneuverability  and  flight  economy  require  control  systems  of 
extremely  high  reliability.  Traditionally  this  requirement  is  fulfilled  by  using  multiple 
devices  in  the  vital  parts  of  the  control  systems.  For  example,  it  is  necessary  to  tri¬ 
plicate  the  hardware  and  to  add  a  majority  voting  mechanism  in  order  to  achieve  a  fail- 
operational  capability. 

However,  it  is  obvious  that  the  conventional  hardware  redundancy  has  many  disadvanta¬ 
ges  due  to  costs,  weight,  volume,  energy  consumption,  failure  rates  and  maintenance 
costs.  Therefore  it  is  reasonable  to  look  for  alternative  methods  which  reduce  the  neces¬ 
sary  efforts  in  hardware  without  loss  of  reliability. 

For  the  sensor  part  of  a  flight  control  system  a  starting  point  for  the  reduction  of 
hardware  is  the  fact  that  the  signals  which  have  to  be  measured  are  output  signals  of 
one  single  plant.  The  plant  itself  is  given  by  the  aircraft  motion  described  by  the 
flight  mechanics  equations.  Hence  the  plant  outputs  are  not  independent  from  each  other 
but  they  are  internally  coupled.  These  relations  given  analytically  can  be  used  for  re¬ 
liability  purposes.  Thus  the  hardware  redundancy  can  be  replaced  by  the  so-called  analy¬ 
tic  redundancy. 

The  basic  tools  for  utilizing  the  analytic  redundancy  are  filters  and  observers. 

Their  algorithms  have  to  be  implemented  into  the  signal  processing  part  of  the  control 
system.  Thus  sensor  hardware  is  replaced  by  computer  software. 

In  recent  years  several  methods  have  been  developed  following  the  described  common 
idea  on  different  ways  [1],  12],  [3],  [4],  151,  [6],  In  this  paper  a  concept  [6]  is  pro¬ 
posed  omitting  the  third  sensor  of  a  triplex  sensor  system.  Nevertheless  the  fail-opera¬ 
tional  capability  shall  be  maintained.  This  is  achieved  by  analytic  redundancy  performed 
in  deterministic  observers.  The  concept  is  applied  to  a  complete  flight  control  system 
similar  to  those  used  in  the  presently  forthcoming  transport  aircrafts.  Flight  test 
results  will  be  shown  in  order  to  demonstrate  how  the  concept  operates  in  a  realistic 
environment. 


2.  SYSTEM  OVERVIEW 


The  closed  loop  control  system 


Fig.  1  shows  the  general  structure  of  the  complete  system  partitioned  into  the  closed 
loop  control  system  on  the  one  hand  and  into  the  failure  detection  system  on  the  other 
hand. 


The  closed  loop  control  system  consists  of  the  plant,  a  duplex  sensor  configuration, 
a  sensor  switching  device  and  the  controller.  The  plant  is  given  as  the  flight  mechanical 
motion  of  the  aircraft,  forced  by  the  control  signals  and  the  disturbances  such  as  air 
turbulence.  The  output  of  the  plant  is  defined  such  that  the  resulting  vector  y  contains 
as  much  information  about  the  plant  state  as  it  is  needed  for  the  control  problem.  The 
output  signals  are  measured  by  sensors  which  are  put  into  a  duplex  sensor  configuration 
in  such  a  way  that  two  identical  sensor  packages  (SP)  arise.  Hence  either  SP  includes 
one  sensor  of  every  sensor  type  (ST).  As  far  as  no  sensor  failure  (SF)  occurs  the  re¬ 
sulting  two  measurement  vectors  Zj  and  Z2  are  identical. 

These  two  sets  of  measurement  signals  are  fed  to  a  controller  via  a  sensor  switching 
device.  In  this  device  the  output  signals  of  a  failed  sensor  is  cut  off.  Output  signals 
of  good  sensors  only  can  past.  This  is  shown  in  fig.  1  for  a  sensor  type  i  according  to 
the  following  scheme > 


No  sensor  failure:  The  sum  of  both  sensor  outputs  in  and  z^2  multiplied  with  the  factor 
O.S  it  fed  to  the  controller. 


Sensor  1  in  SP 1 
failing: 


Only  the  signal  zj.2  ot  the  corresponding  good  sensor  of  SP2  is  fed 
to  the  controller. 


I 
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Sensor  i  in  SP2  Only  the  signal  z | \  of  the  corresponding  good  sensor  of  SPi  is  fed  to 
failing:  the  controller. 

This  scheme  applies  to  each  of  the  existing  sensor  types  (in  fig.  1  shown  for  ST  1 
only).  The  switch  command  signal  is  generated  within  the  failure  detection  logic  as  part 
of  the  failure  detection  system. 

The  controller  is  supposed  to  be  designed  such  that  the  closed  loop  control  system 
meets  the  usual  requirements,  i.e.  good  response  to  command  inputs  and  an  effective 
suppression  of  disturbances  over  a  certain  area  of  the  flight  ervelope. 

2.2.  The  failure  detection  system 

The  failure  detection  part  of  the  complete  system  shown  in  fig.  1  consists  of  two 
identical  deterministic  observers  and  a  failure  detection  logic.  The  observers  operate 
in  the  usual  way.  A  mathematical  model  of  the  plant  is  driven  by  the  control  signals 
already  mentioned  as  input  signals  to  the  real  plant.  The  output  J  of  the  model  is  an 
estimate  of  the  real  plant  output  y.  The  difference  vector  between  the  measured  output  z^ 
(or  z2  reap.)  and  the  estimated  output  (or  Jo  reap.)  in  this  paper  called  the  ob¬ 
server  difference  is  fed  back  to  the  plant  model  via  the  observer  gain  matrix.  This  feed¬ 
back  arrangement  offers  the  opportunity  to  achieve  an  optimal  estimation. 

In  common  applications  observers  are  used  to  provide  additional  information  about  the 
plant  state.  Thus  the  possibility  is  given  to  improve  the  control  performance  in  a  cer¬ 
tain  optimal  way.  Differing  from  those  systems  in  which  the  observers  have  to  be  imple¬ 
mented  into  the  closed  loop  control  system  the  present  concept  uses  the  observers  in  an 
open  loop  manner.  As  fig.  1  shows  the  observers  are  not  used  for  control  purposes  but 
they  are  restricted  to  the  task  of  failure  detection. 

This  task  is  accomplished  with  the  aid  of  the  observers  differences  nj  and  n2  based 
on  the  following  facts.  As  it  can  be  shown  easily  by  the  state  equations  of  the  observers, 
the  observer  differences  are  forced  by 

-  disturbances 

-  plant  parameter  variations 

-  sensor  failures. 

As  far  as  the  relations  between  sensor  failures  and  observer  differences  are  concerned 
it  can  be  seen  from  state  equations  and  also  from  the  block  diagram  in  fig.  1  that  the 
observer  difference  vector  n<\  of  observer  1  is  forced  by  failures  in  the  sensor  package  1 
only.  Equivalently  the  observer  differences  n2  correspond  to  sensor  failures  in  SP2. 

The  effect  of  the  disturbances  and  the  plant  parameter  variations  on  the  observer 
differences  are  identical  in  both  observers.  Furthermore,  they  can  be  assumed  to  be  limi¬ 
ted.  Hence,  the  maximum  response  of  the  observer  differences  due  to  disturbances  and 
parameter  variations  can  be  used  as  thresholds  for  the  sensor  diagnosis  in  the  following 
manner. 

Given  are  the  thresholds  n^  of  each  element  nn  and  n^2  of  the  vector  n^  and  n2*  When 
one  or  more  elements  n^i  of  observer  1  increase  beyond  their  respective  thresholds  n^T» 
it  is  certain  that  a  sensor  failure  has  occurred  in  sensor  package  1 .  Equivalently  an 
occurrence  of  a  sensor  failure  in  SP2  can  be  seen  from  the  response  of  the  observer 
difference  vector  n2. 

The  final  localization  of  a  failed  sensor  within  the  SPI  (or  SP2)  Is  accomplished  by 
the  simple  comparison  between  the  output  signals  of  the  corresponding  sensors  of  the 
same  type.  This  part  of  the  failure  detection  is  identical  to  that  used  in  the  conven¬ 
tional  hardware  redundancy  concepts. 

Based  on  these  relations  the  failure  detection  logic  is  defined  by  the  following 
statements: 


lz11 

-  *12l  +  0 

:  sensor 

failure 

in 

ST  i 

(|r>nl 

>  n)T)v  ( |n21  |  >  n2T)v.... 

:  sensor 

failure 

in 

SPI 

<|n12| 

>  n2T* <  1  n22 1  *  n2T,'v'"-- 

:  sensor 

failure 

in 

SP2 

Using  these  statements  a  failed  sensor  is  clearly  localized.  Then,  switch-off  actions 
are  taken  as  described  in  section  2.1. 

3.  APPLICATION  TO  A  COMPLETE  FLIGHT  CONTROL  SYSTEM  FOR  A  TRANSPORT  AIRCRAFT 
3.1.  The  flight  control  system 

The  failure  detection  concept  is  applied  to  a  given  flight  control  system  for  a  trans¬ 
port  aircraft.  A  simplified  block  diagram  in  fig.  2  shows  the  structure  of  the  closed 
loop  system.  The  objectives  of  the  control  system  are  on  the  one  hand  a  good  response  to 
the  command  signals  defined  as  the  command  vector 
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y 


c 


jaltitude  command  «c 
speed  command  Vc 
I  bank  angle  command  *c 


and  on  the  other  hand  a  sufficient  suppression  of  the  disturbances  w. 


A  good  command  response  is  achieved  essentially  by  a  careful  design  of  the  feedforward 
signal  path,  given  a  well  damped  eigen  behavior  of  the  closed  loop  system  by  choosing 
reasonable  feedback  gains.  Then,  this  latter  property  provides  also  for  a  sufficiently 
low  disturbance  response. 


In  order  to  achieve  these  design  objectives  it  is  necessary,  first,  to  control  the 
plant  via  the  control  vector  u  defined  as 

elevator  deflection  n 
thrust  F 

u  ”  aileron  deflection  £ 
rudder  deflection  t 

. 

and,  secondly,  to  get  the  information  about  the  plant  state  via  the  measurement  vector  z, 
defined  as 


yaw  rate  r 

roll  rate  P 

pitch  rate  q 

bank  attitude  « 

z  *  pitch  attitude  0 

vertical  speed  ft 

altitude  H 


indicated  air  speed  VjAJ 
lateral  acceleration  ay  J 

This  flight  control  system  is  successfully  flight  tested  with  the  DFVLR  experimental 
aircraft  HFB  320.  A  detailed  description  is  given  in  [7], 

The  feedforward  control  loops  are  independent  of  the  measurement.  Hence,  they  do  not 
interfere  with  the  sensor  failure  problem.  On  the  other  hand  the  signal  path  from  the 
measurements  via  the  feedback  law  to  the  control  vector  u  is  of  particular  interest  for 
the  sensor  failure  problem  and  its  solution,  since  via  this  loop  sensor  failures  have  an 
effect  on  the  plant. 

3.2.  The  test  arrangement  for  the  generation,  the  detection  and  the  isolation  of  sensor 
failures 


The  sensor  diagnosis  scheme  needs  a  duplex  configuration  as  represented  in  fig.  1. 

But  in  the  experimental  flight  control  system  only  a  simplex  sensor  system  was  available. 
Therefore  a  slight  modification  of  the  original  concept  became  necessary  for  test  pur¬ 
poses.  This  is  shown  in  fig.  3. 

Given  is  the  single  sensor  package  as  it  was  used  for  the  flight  control  test  program. 
All  measurement  signals  combined  into  the  measurement  vector  z  are  splitted  up  into  two 
separate  signal  paths.  Into  either  path  additive  signals  can  be  fed  represented  by  the 
vectors  vi  and  V2«  Thus  failures  in  sensors  of  the  original  two  sensor  packages  are  simu¬ 
lated  by  software.  The  remainder  of  the  original  scheme  stays  unchanged. 

The  intrinsic  purpose  of  the  experiment  can  still  be  achieved,  i.e.  the  indication  in 
which  of  the  two  sensor  packages  a  failed  sensor  is  located.  Only  the  indication  of  the 
type  of  the  failed  sensor  operates  in  an  unrealistic  condition.  But  as  already  mentioned 
this  Indication  implies  no  innovative  aspects  since  it  arises  in  the  conventional  hard¬ 
ware  redundancy  concepts,  too. 

Fig.  4  shows  in  detail  the  arrangement  of  the  sensors  and  the  internal  structure  of 
the  observers  as  it  was  used  in  the  flight  tests.  For  clarification  purposes  observer  1 
and  the  signal  path  of  the  simulated  sensor  package  1  is  represented  only.  The  represen¬ 
tation  of  observer  2  and  the  SP2  is  identical  to  that  shown  in  fig.  4. 

The  aircraft  motion  model  used  in  the  observers  is  nonlinear.  This  is  done  in  order  to 
keep  the  estimated  outputs  as  close  as  possible  to  the  outputs  of  the  real  plant.  The  non- 
linearities  consist  of 

-  the  coupling  between  the  longitudinal  and  the  lateral  motion 

-  soase  quadratic  terms  depending  on  the  dynamic  pressure 

-  the  thrust  depending  on  Mach  number  and  static  pressure. 


14-4 


The  differences  between  the  measurement  signals  and  the  estimated  outputs  are  fed 
back  to  the  plant  via  the  observer  gain  matrix.  Going  beyond  this  concept  shown  in 
fig.  1  and  described  in  the  original  observer/filter  literature  additional  integral  terms 
are  fed  back,  too.  This  is  done  in  order  to  cancel  possibly  stationary  deviations  in  the 
respective  observer  differences  completely.  The  implementation  of  these  integral  elements 
into  the  observer  structure  does  not  raise  any  problems  either  theoretically  or  practi¬ 
cally.  The  observer  gain  matrix  itself  is  chosen  as  similar  to  the  gains  used  in  the  con¬ 
trol  system.  Though  this  approach  is  not  stringently  optimal  from  the  failure  detection 
point  of  view  it  offers  some  practical  advantages.  Detailed  reasons  are  given  in  [6]. 

In  fig.  4  additional  low  pass  filters  are  attached  to  the  observer  differences  nr  and 
n@.  These  filters  are  not  part  of  the  closed  loop  observers  because  the  corresponding 
filter  outputs  are  free.  But  they  are  used  for  the  sensor  diagnosis  in  the  same  way  as 
the  observer  differences  themselves:  When  a  filter  output  increases  beyond  a  previously 
defined  threshold  the  corresponding  sensor  package  is  indicated  as  that  one  which  is  in¬ 
cluding  a  failed  sensor.  The  purpose  of  these  filters  is  to  imply  further  indication 
signals  which  can  be  made  sensitive  to  particular  failure  cases  by  individually  matching 
the  filter  characteristics.  The  effect  will  be  discussed  using  the  flight  test  results. 

4.  FLIGHT  TEST 


Flight  tests  were  conducted  using  the  DFVLR  test  aircraft  HFB  320.  The  objective  was 
to  demonstrate  the  feasibility  of  the  proposed  sensor  diagnosis  concept  under  a  realistic 
flight  environment.  The  flight  tests  are  partitioned  into  two  parts  according  to  the  out¬ 
lined  concept.  During  the  first  part  data  about  the  parameter  variation  and  disturbance 
effect  on  the  observers  were  collected  for  the  threshold  definition  problem.  In  the 
second  part  the  operation  of  the  failure  detection  and  isolation  was  demonstrated  when 
sensor  failure  signals  were  applied. 

4.1.  Definition  of  thresholds 

The  observer  differences  deviate  from  zero  due  to  parameter  variations  and  disturbances. 
The  response  to  parameter  variations  becomes  high  when  the  control  system  forces  the  plant 
to  move  dynamically.  Therefore,  inputs  into  all  3  command  signal  paths  of  fig.  2  are 
applied  successively: 

-  altitude  command  with  different  descent  and  climb  rates 

-  indicated  air  speed  commands  represented  as  a  deceleration  procedure 

-  bank  attitude  commands. 

The  test  results  shown  in  fig.  5,  fig.  6  and  fig.  7  are  self explanatory  to  a  certain 
extent.  Only  a  few  features  shall  be  discussed. 

Fig.  5:  The  descent  rate  is  800  ft/min,  the  climb  rate  is  1500  ft/min.  Though  during 
the  maneuver  the  plant  moves  considerably  in  altitude  H,  vertical  speed  and  pitch  atti¬ 
tude  0  the  corresponding  observer  differences  remain  small.  Only  the  signal  ne  shows  up  a 
certain  offset  which  becomes  even  clearer  in  the  output  n of  the  attached  low  pass  filter 
This  effect  may  be  referred  to  an  unprecise  modelling  of  tne  actual  thrust. 

Fig.  6:  The  deceleration  procedure  is  carried  out  partly  in  medium  air  turbulence.  Un¬ 
expected  is  the  result  that  obviously  the  lateral  motion  is  excited  by  the  deceleration 
maneuver  which  theoretically  should  be  a  matter  of  the  longitudinal  motion  only.  This 
effect  is  due  to  a  peculiar  feature  of  the  test  aircraft.  Some  unsymmetries  of  the  aileron 
system  show  up  when  the  dynamic  pressure  is  varying.  In  the  stationary  case  the  feedback 
of  the  integrated  observer  difference  n$  cancels  the  unsymmetries  effect. 

Fig,  7:  The  bank  attitude  +  moves  with  a  certain  rate  which  is  defined  within  the  flight 
control  system.  During  the  transient  phases  some  deviations  in  the  observer  differences 
arise,  particularly  in  n#. 

In  all  three  figures  there  is  a  bias  in  the  observer  difference  nay.  Obviously  this  is 
due  either  to  a  bias  in  the  lateral  accelerometer  Itself  or  to  a  nonnorizontal  mounting. 

During  the  test  flights  an  area  of  heavy  air  turbulence  was  sought  and  found  during  a 
descent  passing  a  strong  cumulus.  The  results  are  shown  in  fig.  8. 
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Based  on 
as  shown  in 


these  data  the  thresholds  for  the  second  part  of  the  flight  test  were  fixed 
the  first  column  of  table  1* 


OBSERVER  DIFFERENCE 
THRESHOLDS 


nrT 

= 

1 .0 

°/s 

"pT 

= 

2.0 

°/s 

n6T 

= 

1 .0 

°/8 

n  _ 

a 

2.5 

o 

n9T 

* 

1  .0 

o 

nHT 

* 

2.0 

m/s 

nHT 

= 

4.0 

m 

"VT 

* 

2.0 

m/s 

nayT 

n8FT 

0.5 

0.5 

m/s 

o 

nrFT 

0.25 

°/s 

SENSOR  FAILURE 
FACTORS 


ay 


3  °/s 
5  °/s 
5  °/s 
10  ° 

3  ° 

5  ra/s 
50  m 
10  m/s 
5  m/s2 


TABLE  1:  THRESHOLDS  AND  SENSOR  FAILURE  FACTORS 


4.2.  APPLICATION  OF  SENSOR  FAILURES 


As  represented  in  fig.  3  and  fig.  4  sensor  failures  are  generated  by  feeding  additive 
signals  into  one  of  the  two  sensor  signal  paths.  This  is  done  successively  for  each  of  the 
sensors  of  one  sensor  package.  Because  the  arrangement  of  the  sensor  packages  is  symme¬ 
trical  with  respect  to  both  the  control  system  and  the  observers,  sensor  failures  are 
applied  to  the  SP1  only.  Consequently  the  index  1  is  omitted  in  the  succeeding  repre¬ 
sentations.  The  plots  of  the  failure  signals  are  equal  but  multiplied  with  an  individual 
factor  given  in  the  second  column  of  table  1.  The  common  structure  of  the  failure  plots 
is  defined  in  fig.  9.  Since  the  signal  character  of  the  sensor  failures  is  important  with 
respect  to  their  effect  on  the  control  system  on  the  one  hand  and  to  the  failure  detecta¬ 
bility  on  the  other  hand  the  plot  of  fig.  9  is  partitioned  into  three  different  intervals. 

Interval  *  10-60  sek":  During  this  period  the  failure  signal  increases  on  a  slight  slope, 
thus  simulating  a  small  drift  of  the  physical  sensor. 

Interval  "60-70  sek":  A  stationary  offset  is  represented. 

Interval  "70-80  sek":  A  steep  decrease  to  zero  is  simulating  a  high  drift  rate.  Thus  a 
failure  signal  containing  higher  frequencies  is  represented. 

The  sensor  failures  were  applied  during  a  straight  level  flight  in  fairly  calm  air. 

Thus  the  effect  of  the  failures  become  clear  because  they  are  only  little  disturbed  by 
air  turbulence  or  maneuvers.  In  fig.  10,  fig.  11  and  fig.  12  test  results  are  shown  re~ 
spective  to  failures  in  the  Q-sensor,  the  VIAS-sensor  and  the  p-sensor.  In  these  figures 
the  plots  of  the  most  relevant  variables  are  given  showing  in  the  first  columns  the  system 
responding  to  the  complete  failure  signal  profile  without  to  be  interfered  by  sensor 
switching.  In  the  respective  second  columns  the  operation  of  the  switching  logic  becomes 
obvious . 

Fig.  10:  The  additive  failure  signal  in  the  0-sensor  clearly  shows  up  in  the  observer 
difference  nQ  and  similarly  in  the  filter  output  nep.  The  aircraft  motion  itself  is  al¬ 
most  unaffected  by  this  kind  of  failure,  even  during  the  steep  decrease  interval.  The 
failed  sensor  is  detected  when  the  filter  output  nQp  increases  beyond  its  threshold.  At 
this  time  the  switch  command  signal  appears.  At  the  corresponding  moment  of  fig.  10  b  the 
switching  operations  take  place  actually. 

Fig.  11:  The  application  of  the  failure  to  the  VIAS-sensor  shows  results  very  much 
different  from  those  of  the  previous  failure  case.  Here,  the  plant  variable  VIAS  follows 
the  faulty  measurement  in  the  Vi^s“#ensor  whereas  during  the  low  rate  drift  interval  the 
corresponding  observer  difference  nv  remains  close  to  zero.  This  means  that  the  observer 
difference  ny  is  unusable  for  the  detection  of  slow  drift  rate  failures.  It  indicates 
only  higher  drift  rate  failures  as  demonstrated  during  the  steep  decrease  interval.  But 
low  drift  rates  have  an  effect  on  the  observer  difference  ne  based  on  the  coupling  between 
speed  and  pitch  attitude  within  the  plant  and  its  model.  This  relation  can  be  used  for 
the  failure  indication  particularly  by  the  filter  output  n@p  since  the  previously  de¬ 
fined  disturbance  threshold  nrpr  i*  small  due  to  the  low  pass  filtering  property.  Hence, 
f  this  filter  output  activates  the  switching  operations  in  fig.  11  b. 

Fig.  12:  These  plots  show  an  example  of  a  failure  in  a  lateral  motion  sensor.  From  a 
systems  theoretical  point  of  view  this  failure  case  appears  to  be  similar  to  that  of  a 
failure  in  the  9-sensor  in  fig.  10. 

Failures  of  the  remaining  sensors  can  be  classified  either  as  similar  to  the  failure 
of  the  d-sensor  (r-,  6- ,  ft-,  Sy- sensor)  or  as  similar  to  the  failure  of  the  VIAc-sensor 
(+-,  H-sensor) .  As  far  as  the  low  drift  in  the  ^-sensor  is  concerned,  the  relation  between 
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bank  attitude  «  and  yaw  rate  r  is  utilized  amplified  in  the  filter  output  nrp.  However, 
for  the  H-sensor  an  equivalent  relation  is  not  existing.  Hence  drift  failures  in  this 
sensor  must  be  declared  as  undetectable. 

5.  FURTHER  REMARKS 

In  the  presented  concept  sensor  signals  are  considered  as  output  signals  of  individual 
sensors.  But  with  many  flight  control  systems  more  than  one  measurement  signal  are  re¬ 
ceived  from  one  single  hardware  unit.  For  instance,  with  the  presented  example  the  pitch 
0  and  the  bank  attitude  ♦  are  obtained  at  the  common  inertial  platform.  Hence,  it  has  to 
be  assumed  that  a  failing  platform  generates  failures  in  both  outputs.  But  this  failure 
case  is  also  covered  because  the  function  of  the  failure  detection  is  preserved  as  long 
as  simultaneous  failures  are  located  in  the  same  sensor  package. 

During  the  flight  tests  a  fixed  failure  signal  profile  was  used.  But  in  order  to  assess 
the  performance  of  the  detection  concept,  worst-case  failures  have  to  be  applied.  A 
thorough  study  of  this  problem  is  given  in  [6]  where  optimal  control  methods  are  used  in 
order  to  define  the  worst-case  failure  of  any  sensor.  At  this  place  it  can  be  noticed: 

The  low  drift  in  the  VIAS-sensor  shown  in  fig.  11  is  of  the  worst-case  kind. 

As  already  mentioned  and  described  in  more  detail  in  [6],  it  is  reasonable  to  choose 
the  observer  dynamic  as  similar  to  the  dynamic  of  the  closed  loop  control  system.  But  this 
solution  is  not  optimal  in  a  strict  sense.  The  optimization  of  the  observer  gain  matrix 
for  the  presented  failure  detection  method  is  still  an  unsolved  problem.  But  already  at 
this  time  it  can  be  said  that  the  design  as  a  Kalman  filter  is  not  optimal.  Neither  the 
performance  index  should  be  of  a  quadratic  type  nor  the  measurement  noise  can  be  assumed 
l.s  Gaussian.  Actually  the  optimization  has  to  be  done  with  respect  to  deterministic, 
precisely  definable  sensor  failures. 

6.  CONCLUSION 

For  the  sensor  part  of  a  flight  control  system  a  diagnosis  scheme  has  been  developed. 
Based  on  analytic  redundancy  a  duplex  sensor  configuration  supported  by  deterministic 
observers  achieves  the  fail-operational  capability  of  a  conventional  triplex  system.  The 
concept  was  applied  to  a  flight  control  system  of  a  transport  aircraft.  Flight  tests 
have  shown  that  in  principle  the  failure  detection  concept  is  feasible  with  commonly  used 
sensors.  Only  certain  failures  of  the  altitude  sensor  are  undetectable  due  to  the  fact 
that  the  altitude  has  to  be  considered  as  the  state  of  a  free  output  integrator.  As  far 
as  the  operational  performance  of  the  detection  concept  is  concerned  it  can  be  reported 
from  the  flight  tests  that  the  performance  was  at  least  high  enough  not  to  upset  the 
pilots. 

7.  REFERENCES 

Detecting  instrument  malfunctions  ir.  Control  systems. 

IEEE  Trans,  on  Aerospace  and  Electronic  Systems  Vol.  AES- 11 
(1975)  No.  4,  pp.  465-473. 

Software  techniques  for  redundancy  management  of  flight  control 
systems. 

Proc.  of  AIAA  Guidance  and  Control  Conference,  Aug.  1976. 

F8-DFBW  sensor  failure  identification  using  analytic  redundancy. 
IEEE  Trans,  on  Automatic  Control,  Vol.  AC-22,  795-803,  Oct.  1977. 


Application  of  analytical  redundancy  management  to  shuttle 
crafts. 

Proc.  of  the  1978  IEEE  Conf.  on  Decision  and  Control,  San  Diego, 
Cal.,  Jan.  10-12,  1979. 

Automatic  recovery  after  sensor  failure  on  board. 

AGARD  Conf.  Proc.  No,  272,  Ottawa,  Can.,  May  8-11,  1979. 

An  observer  approach  to  the  identification  and  isolation  of  sen¬ 
sor  failures  in  flight  control  systems. 

ESA-TT-738  (English  Translation  of  DFVLR-FB  81-26) . 


[1]  Clark,  R.N., 
Fosth,  D.C., 
Walton,  V.M. 

12)  Shapiro,  E.Y. 


1 3)  Deckert,  J.C., 
Desai,  M.N., 
Deyst,  J.J., 
Willsky ,  A.S. 

1 4 3  Montgomery,  R.C., 
Tabak ,  D . 


[5)  Labarrere,  M., 
Pelegrin,  M., 
Pircher,  M. 

[6]  Stuckenberg,  N. 


[7]  Adam,  V. , 

Leyendecker,  H. 


Control  law  design  for  transport  aircraft  flight  tasks 
AGARDograph  No.  251. 


SENSOR 

PACKAGE 


10  FAILURE  DET.  LOGIC 
ANO  FEEDBACK  CONTROL 


v, Additive  signal  in  sensor  i  of  SP1 
v12:  Additive  signal  in  sensor  i  of  SP2 

Fig.  3:  Software  realization  of  two  sensor  packages 


Fig.  4:  Experimental  sensor  and  observer  arrangement 


a.  without  switching  b.  with  switching 

Fig.  lOt  Response  to  failures  in  the  e-sensor 


a:  without  switching 

Fig.  10:  Response  to  failures  in  the  Vj  -sensor 


b:  with  switching 


a:  without  switching 

Fig.  11s  Response  to  failures  in  the  p-sensor 


b:  with  switching 
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RESUME 


La  maintenance  intltgr£e  a  pour  but  d' assurer  la  maintenance  premier  Echelon 
des  syst&oes  d'aroes,  et  de  ce  fait  dolt  peroettre  1 ' Identlf Icacion  d'URP 
(Unites  Rempla^ables  en  Piste)  en  panne  et  la  validation  des  chalnes 
fonct lonnelles,  sans  qu'll  solt  n6cessalre  de  recourlr  3  1 'utilisation 
d'^qulpetnents  ext&rleurs  au  systeme  lui-mSoe.  Ce  concept  est  rendu  possible 
par  lea  technologies  nua&rlques  actuellement  utilisees  et  par  une  architecture 
du  sysedoe  d'armea  adapt£e*  En  particulier  les  syst ernes  diveloppis  pour  les 
MIRAGE  2000  se  prStent  bien  1  cc  type  de  maintenance  du  fait  que  les  tquipements 
sont  rellSs  entre  eux  par  un  bus  nua$rique  3  gestion  centralist,  gestlon  assur6e 
par  un  seui  calculateur  denoiam£  principal  ou  tactlque. 

La  maintenance  int£gr§e  comprend  : 

-  Une  maintenance  r€alls£e  pendant  le  fonct ionnement  operatlonnel  du  sysc£me 
d'aroes,  bast  sur  une  surveillance  pernanente  du  fonct ionnement  des  £qulpements 
et  l'enreglstreoent  des  anomalies  pendant  le  vol . 

-  Une  maintenance  rtalist  pendant  un  fonct Ionnement  partlculler  du  systime 
d'aroes  et  pernettant  des  tests  plus  profonds  dans  les  equlpements  ainsl  que 
la  verification  de  tous  les  ^changes  d 'information  s'effectuant  par  le  bus 
numfrique  ou  par  des  liaisons  point  i  point  analoglques  ou  dlgitales. 

Pendant  ce  fonct Ionnement  "Maintenance"  le  systime  d'aroes  n’assure  plus 
aucune  fonctlon  opiratlonnelle. 

La  premiere  partle  de  1' expose  presente  les  implications  materlelles  et  logicielles 
des  fonctions  de  malntenablllte  accomplles  par  les  equlpements  en  dlstlnguant  : 

-  lea  diaposltlf9  exploltes  pendant  le  fonct Ionnement  operatlonnel 

-  les  dispositlfs  exploltes  pendant  le  fonct ionnement  maintenance* 

La  seconde  partle  de  1* expose,  decrlt  les  loglclels  de  la  maintenance  lntegree  au  niveau 
du  calculateur  principal  du  systiae,  gerant  le  bus  numerique. 


-  INTRODUCTION 


Dans  les  syatime*  d'armea  organises  autour  d'un  bus  numerique  multiplexe  1  gestlon  centrallaee, 

1 'organisation  des  echanges  d' Informations  est  le  fait  d'un  equipement  "Malt re"  (Calculateur  principal 
ou  tactlque)  gfrent  un  flot  d' informations  circulant  sur  un  support  filaire  unique*  Af In  de  mlnlmlaer 
le  noabre  et  l'ampleur  des  equlpements  de  maintenance  exterleura  ft  1* avion,  11  faut  a'ef forcer  1  ce 
que  le  moyen  prlvlllgie  permettent  les  Cchangea  d' Informations  "operatlonnel lea"  solt  ausal  le  moyen 
privlUgie  d’tchange  des  Informations  et  des  procedures  de  meintenence. 

Par  allleura,  et  sur tout  en  ce  qul  concerne  les  equlpements  organises  autour  d'un  operateur 
programme,  le  test  par  simulation  de  fonct ionnement  doit  itre  remplace  par  un  test  decompose  en 
plusieurs  sequences  permettent  de  verifier  l'lntCgrlte  des  dlfferentes  parties  de  1 'equipement  de 
faqon  autonome  et  ausal  compliteaent  que  possible.  D'eutre  pert,  le  prlncipe  de  meintenence  lntegree 
dolt  about ir  1  ce  qua  cheque  equipement  concoure  1  le  meintenence  globele  du  systime  d' ernes* 

L' etude  de  le  meintenence  lntegree  pour  un  systems  d'ermes  donni  dibute  dia  le  conception  dee 
equlpements  et  de  1 'architecture  du  systime*  A  cat  effet  la  SocUtl  AMD-lA  e  ridlge  un  document  de 
specifications  generales  de  aalntenablllti  des  equlpements  qul  e  pour  objet  d'obtenlr  une  bonne 
homoglneite  des  procedures  de  maintenance  s'eppllquent  1  des  soue-ensemble*  fonct lonnel lament 
slmllalree  et  d'itabllr  un  premier  scheme  de  le  meintenence  ginerale  du  systime*  Ensulte  dCbute  une 
phase  d 'etude  complete  de  1 'application  dea  specifications  fqulpemsnt  per  equipement  efln  d'obtenlr 
une  definition  dCtailUe  dee  dlepoeltlfs  loglclels  et/ou  materials  de  meintenence  dene  lee  equlpementa* 
II  set  evident  que  1 'ensemble  des  dispositions  de  malntenebllltf  au  premier  icheloo  applicable#  i 
un  equipement  conduit  nicesealrement  i  dee  eugmentatlone  de  material  et/ou  loglclel  embarquts* 

Ces  eugmentatlone  doivent  it re  contrftlCes  et  rifiechiaa  car  el lee  peuvent  entrelner  : 

-  une  reduction  de  flablllti 

-  une  diminution  de  le  aicurlti 

-  une  augmentation  des  masses  et  volumes 

-  une  augmentation  du  prix  du  material* 
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II  est  done  nAcessaire  dans  tous  les  cas  d 'examiner  ces  aspects  de  faqon  A  rAallser  an  coaproals 
acceptable  entre  toutes  ces  exigences  qul  sont  parfols  contradlctolres.  A  tltre  indlcatlf  nous  avons 
flxA  les  liaites  sulvantes  : 

.  Le  pourcentage  d ' Instructions  dlrecteaent  ll£es  A  la  maintenance  par  rapport  A  1' ensemble  des 
Instructions  d'un  loglclel  d' Aqulpeaent  ne  dolt  pas  dApasser  15  A  20Z. 

«  Le  pourcentage  des  AlAaents  aatArlels  dlrecteaent  ll£s  A  la  aalntenance  par  rapport  & 

1' ensemble  des  AlAaents  aatArlels  de  1 'Aqulpeaent  ne  dolt  pas  dApasser  10  A  12X. 

Ces  chlffres  sont  discutAs  pour  chaque  Aqulpeaent  afin  d' about l r  au  aeilleur  coaproals. 

La  maintenance  int£gr£e  coaprend  deux  parties  dlstinctes  : 

-  Une  maintenance  r£alls£e  A  partlr  des  tests  et  autotests  qul  ne  perturbent  pas  le  fonct lonneaent 
opAratlonnel  du  systAme  d'armes  et  qul  est  done  effective  avion  en  vol  ou  au  sol.  Ces  tests  et 
autotests  n'ont  pas,  A  eux  seuls,  un  taux  de  couverture  suffisant  pour  assurer  une  maintenance 
premier  Echelon  satlsfalsante. 

-  Une  aalntenance  r£alls£e  A  l'aide  de  procedures  perturbantes  pour  le  fonct lonneaent  opArationnel  du 
systAme  d'armes  permettant  de  complAter  les  tests  systAaes  et  autotests  Aqulpeaents-  Cette  seconde 
partle  de  la  maintenance  int£gr£e  est  obtenue  par  1'utilisatlon  d'un  mode  de  fonct lonneaent 
particuller  du  systAme  d'armes  appelA  "fonct lonneaent  maintenance  au  sol".  Dans  ce  mode,  les  £qui- 
pements  abandonnent  leur  fonct lonneaent  opAratlonnel  pour  n'effectuer  que  des  tiches  strlctement 
maintenance  ayant  pour  objet  de  coaplAter  la  verification  de  leurs  fonctlons  internes  et  de  coop£rer 
A  la  maintenance  systAae  :  en  particuller  donner  la  posslblllte  de  verifier  tous  les  £changes 

d’ informations  effectu£s  solt  par  le  bus  aultiplex£  soit  par  les  liaisons  point  A  point  nua£rlques 
ou  analogiques. 

Cea  deux  aspects  compl£mentaires  de  la  aalotenance  lntAgrAe  condulsent  A  la  realisation  de  deux 
families  de  disposltlfs  aaterlels  et  Jogiclels  de  aalntenabllltA  sussl  blen  pour  les  £qulpements  que 
pour  le  g£rant  du  bus  multlplexA. 
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2  -  MAINTENABILITE  DES  EQUIPEMENTS 


Les  equipeaents  d'un  systAae  d'armes  lnt£gr£  peuvent  Atre  classes  en  cinq  types  : 

-  Les  Aqutpements  analogiques  ou  A  loglque  cAbl£e  non  rell£s  au  bus  nuaArlque  multlplexA 

-  Les  Aqulpeaents  A  processeurs  non  relies  su  bus  nuaerlque  aultlplex£ 

-  Les  equipeaents  1  loglque  cAblAe  relies  su  bus  nuaerlque  multlplex£ 

-  Les  Aqulpeaents  A  processeurs  reliAs  au  bus  nuaArlque  multlplexA 

-  Les  equipeaents  A  calculateur  unlversel  relies  au  bus  nuaerlque  aultlplexe. 

La  aalntenabllltA  des  equipeaents  comprend  deux  sArles  de  disposltlfs  : 

-  des  disposltlfs  qul  sont  operants  pendant  le  fonct lonneaent  op€ratlonnel 

~  des  disposltlfs  qul  ne  sont  opArants  que  pendant  le  fonct lonneaent  maintenance. 


2.1  -  Equipeaents  analogiques  ou  A  loglque  clblAe 

Ces  Iqulpeaents  sont  cons id 4 r£s  comae  n’£tant  pas  rell4s  su  bus  nua4rtque  aultlplex4  et  ne  sont 
capable*  que  du  seul  fonct lonneaent  op4rationnel  :  leur  aalntenabblit4  est  de  type  classlque. 

Us  coaportent  : 

-  Un  certain  noabre  de  disposltlfs  aat4rlela  survelllant  une  part  plus  ou  aolns  lraportante  des 
fonctlons  r4alls4es.  Cet  enseable  de  surveillances  dolt  aboutlr  A  la  confection  d'une 
information  tranaalsa  par  un  dlscret  vers  un  autre  Aqulpeaent  qul,  rell4  au  bus,  le  trans- 
aettra  au  g4rant  du  systAae. 

-  Un  dlsposltlf  peraettant  de  posltlonner  les  Informations  de  sortie  de  l'4qutpeaent 

.  solt  A  une  valeur  d4flnle 

•  soit  A  un  Acart  connu  par  rapport  A  une  valeur  actuelle. 

Ce  dlspoaltlf  dolt  appllquer  les  Inforaatlons  de  posit lonneaent  le  plus  en  aaont  possible  sur 
les  chalnes  de  tralteaent.  La  aise  en  oeuvre  de  ce  dlsposltlf,  perturbant  pour  le  fonctlon- 
neaant  opAratlonnel  da  1 'Aqulpeaent  peut  Atre  dAclenchA 

.  manual leaent  par  un  bouton-poussoir  fugltlf 

.  Alectrlqueaent  par  1'lnteraAdlaire  d'un  dlscret  provanant  d'un  Aqulpeaent  connectA  au  bus 
nua4rlquc. 

La  terms  "inforaatlons  de  sorties"  recouvrt  aussl  blen  les  informations  "Alectrlques"  (par  exeaple 
valeur  de  tension)  que  lee  Inforaatlons  vlsuallsles  au  pilots  par  1'lnteraAdlaire  d' aiguilles, 
de  drapeeux  etc... 


Par  alllaurs,  11  y  a  lieu  de  consldArer  deux  types  de  tests  dAclenchAs  : 

-  Les  tests  "pilots"  dont  le  dAclencheaent  s'effectue  uniqueaent  en  cockpit  lors  du  vol  ou 
lorsque  1 'avion  ast  au  sol,  sur  action  du  pilots.  Pour  ce  type  da  test,  le  retour  A  la 
configuration  "opAratlonnalla"  da  l'lqulpeaent  A  la  fin  ou  A  1' interrupt Ion  du  test  dolt 
ss  fslrs  dans  un  tsaps  InfArlsur  A  1  seconds. 

*  Les  tests  "aAcanlclen"  dont  Is  dAclsnchsaent  s'effectue  soit  en  cockpit  solt  dlrecteaent  sur 
1 'Aqulpeaent  quel  que  solt  Is  mods  ds  fonct lonneaent  du  eystlas  :  opArationnel  ou  aslntenance. 
Pour  cs  type  de  test,  le  retour  su  fonct loaneasot  hors  east  s'effectue  dans  un  temps  pour 
lequel  11  n'y  s  pss  de  epic if lest lone  pert  leu 11 Ares. 


Pendant  la  diroulaasnt  da  la  elquence  da  test,  1' information  de  boo  fonct lonneaent  dlsparalt  et  ne 
revient  A  l'Atat  bon  fonct lonneaent  qu'une  fols  le  sAquence  achevie,  c'eat-A-dlre  su  aoaent  du 
posit lonneaent  "test"  dsa  sorties.  Per  ailleurt,  un  dlscret  "test  sn  cours"  doit  Itrs  envoy#  vers 
le  aystftme. 
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2.2  -  Equlpemonta  i  proceaaeur  non  rellti  au  bug  numtrlque  multiplex! 

Ce  type  d'tquipement  cwporu  une  partle  fonctlonnelle  de  base  (fonctlon  cepteur)  utocUe  t  un 
proceaaeur.  La  malntenablllt!  de  la  fonctlon  de  base  eat  assurte  de  la  iIm  aanltre  que  pour  lea 
tqulpements  analoglquea  ou  2  loglque  ctblte. 

Lea  dlapoaltlfa  de  teat  au  niveau  du  proceaaeur  aont  lea  aulvanta  : 

-  Teat  de  la  mtmoire  progrtmme 

L'lnttgrltt  du  eontenu  mtmoire  programme  eat  vtrlflte  par  1* intermtdlalre  d'une  somme  de 
contrfile  (check-sum)  a'exer^ant  pendant  tout  le  te*ps  de  fonctlonneaent  de  l'tqulpement. 
Cette  somme  de  contrSle  doit  ttre  au  molns  l'additlon  de  toutea  lea  inatructlona  contenuea 
dans  la  mtmoire  programme  et  coaparalson  du  rtsultat  avec  une  valeur  de  conalgne  insert te 
dans  cette  mtmoire  progrnnac. 

-  Teat  dea  unltta  arithattlques  et  loglquea  (Unit!  Centrale) 

Ce  teat  eat  effectut  par  la  rtallsstlon  d'un  calcul-type  ayant  pour  but  de  faire  fonctionner 
un  maximum  de  circuita. 

-  Teat  du  dfcrouleaent  de  progrwae  (Watch  dog) 

Ce  test  eat  effectut  aoui  forme  d'une  lnatruction  extcutte  cycliquement ,  ayant  pour  effet 
de  rtarmer  un  diepoeitif  mattriel  (aonoatable  rtarmable).  En  cas  de  non-extcutlon  de  cette 
lnatruction  dana  la  fenitre  de  tea pa  de  rtaraement  du  diepoeitif,  une  information  de  meuvals 
fonctlonnement  eat  dlsponlble. 

-  Teat  dee  codeura  d'entrte/aortlc 

Dana  le  cas  oCi  l'tqulpement  poaatde  cea  deux  dlapositlfs,  un  test  dea  codeurs  eat  extcutt 
aulvant  la  procedure  aulvante  : 

•  Sur  une  vole  du  codeur  numtrlque/ ana loglque  :  demand e  de  codage  en  analoglque  d'une 
valeur  numtrlque  connue  par  programme. 

.  Rebouclage  de  cette  Information  analoglque  aur  une  vole  du  codeur  analoglque/nuatrlque 
qul  la  transforme  en  numtrlque. 

•  Coaparalson  du  rtsultat  avec  la  valeur  d'orlglne. 

Dana  le  caa  oQ  l'tqulpement  ne  poastde  qu'un  codeur  analoglque/ numtrlque  le  teat  a'effectue 
par  codage,  aur  une  vole,  d'une  valeur  de  tension  de  rtf trance  Interne  1  l'tqulpement  et 
coaparalson  avec  la  valeur  numtrlque  ttmoln  correa pond ante. 

L'ensenble  de  cea  autoteata  a'effectue  en  tftche  de  fond  programme  et  ne  perturbe  done  paa  le  fonc- 
tlonnement  optratlonnel  de  l'tqulpement,  lie  contrlbuent  1  1* Elaboration  d'un  signal  de  bon 
fonctlonneaent  global. 

Tralteaent  du  rtsultat  dea  autoteata 


Autotea tn  fonctlofloela 

Cea  autoteata  a'exercent  aur  lea  fitment*  de  l'tqulpement  autrea  que  le  proceaaeur  proprement  dlt. 
Pour  chacun  d'eux,  un  filtrage  peut  it re  effectut  par  l'tqulpement  lul-mtme.  L' Indication  de  panne 
vers  lea  tqulpementa  ptrlphf riquea  doit  ttre  cohtrente  avec  le  filtrage,  c'eat-1-dlre  que  ce  n'eat 
qu'A  1* Issue  du  filtrage  que  l'on  poaltlonnera  lee  Informations  d'ttat  A  bon  ou  1  mauvala  fonctlon¬ 
neaent* 

Autoteata  Proceaseur 

On  claaae  dans  cette  catfcgorle  lea  autoteata  a'exerqant  unlqueaent  aur  le  proceaaeur  : 

Testa  UAL  ou  UT 
Soaae  de  contrSle 
Teat  de  parltt 

Teat  de  la  rone  mtmoire  de  travail  si  celul-ci  a'exerce  en  permanence. 

Toua  cea  autoteata,  en  caa  de  dtclencheaent  ont  pour  effet  l'arrtt  du  prograauae  aana  qu'aucun 
filtrage  ni  temporlsatlon  ne  eolt  effectut,  et  1* Indication  de  panne  dolt  ttre  Immediate. 

Le  chlen  de  garde  peut  dtclencher  de  deux  manltres  : 

-  d'une  part,  suite  A  un  arrtt  programme  occasional  par  le  dtclenchement  d'un  dea  autoteata 
prtetdente. 

-  d 'autre  part,  par  la  non  execution  de  l'instructlon  de  rtaraement  du  chlen  de  garde  dana  le  cas 
oU  lea  autoteata  prtetdente  ne  dtclenchent  pas. 

Alnai,  le  chlen  de  garde  eat,  lndirectement,  le  OU  loglque  dea  rtaultate  dea  autoteata  du  proceaaeur. 
La  retoabte  du  chlen  de  garde  dolt  entralner  l'arrtt  du  programe.  Loraqu'un  auto teat  eat  dtclencht 
entralnant  l'arrtt  du  programme,  pluaieura  caa  aont  possibles  : 

-  Loraque  le  programme  eat  enreglatrt  dana  une  otmolre  fonctionnant  en  cycles  "lecture-tcrlture" 
(tores  ...)  l'arrtt  dolt  ttre  dtflnltlf  Jusqu'A  la  mlae  hors  tension  du  aysttme  d'armea* 

-  Loraque  le  programme  eat  enreglatrt  aur  une  mtmoire  "morte"  (ROM,  PROM,  RBPROM,  etc.)  l'arrtt 
programme 

.  dolt  ttre  dtflnltlf  Juaqu't  la  mlae  hors  tension  du  aysttme  d'armea  pour  lea  tquipe- 
menta  ayant  besoln  du  "pasat"  pour  continuer  de  fonctionner  correctement. 

•  peut  ttre  temporalre  pour  lea  tqulpements  travalllant  en  temps  rtel  et  n' ayant  pea 
besoln  du  “pa a at"  pour  travalllcr  correctement  :  dana  ce  caa,  une  atquence  de  rtlni- 
tial last Ion  l'tqulpement  peut  ttre  entreprlae  et  rial late  une  ou  pluaieura  fols. 

.  SI,  au  terms  d'un  certain  nombre  de  tentative!  de  rtlnltlallaatlon  11  eat 
Impossible  pour  le  proceaaeur  de  travel Her  correctement,  l'arrtt  programme  sera 
dtflnltlf  Juaqu't  la  mlae  hors  tension  du  aysttme  d'armea. 

.  SI  la  procidure  de  rtlnltlallaatlon  du  proceaaeur  aboutlt  t  un  fonctloonement 
correct  l'tqulpement  eat  rtlnltlallst  normalement  avec  dlsparltlon  de  1' Indication 
de  panne. 

-II  faut  remarquer  qu'une  coupure  rtaeau  sera  lnterprttte  par 
soua  tension  aprts  coupure  du  aysttme  d'armea. 

-  En  caa  d'arrtt  programme,  lea  sorties  analoglquea  (hors  bus) 
dana  un  ttat  non  dangereux  ou  prtftrentlel 

.  pour  la  sicurltt  de  vol 
.  pour  lea  tqulpements  ptrlphtrlques. 


lea  tqulpements  comma  une  remlae 
de  l'tqulpement  aont  posltlonotes 
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i®***  i  Ai  proceaaeur 

A  1  *  Initialisation  du  proceaaeur,  1 'Jquipement ,  en  tic  he  pr loci pale,  ef fee Cue  lea  autoteata 
solvents  t 

-  Test  des  Unit(a  Arlthmitiques  at  Loglquea 

-  Somme  de  contrfile  de  is  mimolre  programme 

-  Teat  de  la  zone  mimoire  de  travail* 

L’ordre  dans  1 equal  s'effectuent  cea  autoteata  Import*  peu.  Lorsque  le  proceaaeur  a  aatlafait  i 
cea  contrOlea,  le  prograaae  eat  lane*  et  le  chlen  de  garde  eat  a  sag  pour  la  prealire  fols. 
Enaulte,  lea  autoteata  proceaaeur  sont  exicutia  en  tftche  de  fond  (1  1' exception  du  test  de  la 
zone  a£»olre  de  travail  dana  la  plupart  dee  caa). 


2.3  -  Equipeaenta  i  logique  ciblie  rellie  au  bua  oumirlque  multlplexi 

Le  couplage  au  bua  numirlque  multlplexi  s’effectue  par  l'lntermidlalre  de  deux  iliments  : 

-  Le  coupleur  standard  du  bua  (COS)  qul  peraet  de  recevolr  et  d'imettre  lea  informations  sur  le 
bus.  Ce  dispoaltlf  eat  coumun  1  toua  lea  (quipements  relics  au  bus. 

-  Le  coupleur  sous- aye time  (CSS)  qul  permet  lf organisation  dea  (changes  entre  le  COS  et  l'iquipe- 
meot  lul-*(*e,  et  contlent  en  partlculler  lea  tables  d '(changes  bua* 

La  malntenabilltC  des  (quipements  1  logique  ciblie  rellia  au  bus  eat  la  mime  qua  celle  dicrite  au 
paragraphs  2.1  mala  le  fait  d'etre  relit  au  bus  permet  la  realisation  de  dlsposltlfs  compltmentalrea 
de  teat  utilises  pendant  le  fonctionnement  opirstlonnel  ou  le  fonctlonnement  maintenance  du  syatdme 
d'armea* 

jte^n£e£a]>ilip(j>endant_le  joytlonnyntjc^rztlQMyl 

En  plus  dea  dlsposltlfs  dicrits  au  paragraphs  2*1  ce  type  d '(qulpement  poaaide  lea  possibilitis 
aulvantea  : 

-  Surveillance  dea  niveaux  d 'alimentation  pour  1* alimentation  du  COS.  Lea  alimentations  du  COS 
aont  surveillies  de  telle  manlire  que  lorsqu'lls  n'ont  plus  lea  toltrances  permet t ant 

d' assurer  un  fonctionnement  correct  du  coupleur  bus,  11a  Inhibent  l1 (mission  aur  le  bus* 

-  Teat  de  connexion  :  Ce  teat  a  pour  objet  de  reboucler  une  information  reque  par  le  COS  sur  sea 
circuits  d '(mission  et  retransmission  aur  le  bus.  Ce  teat  eat  pllot(  par  le  g(rant  et  n'a  pour 
r91e  que  de  v(rlfler  le  bon  fonctlonnement  des  circuits  du  coupleur  de  bus.  Ce  test  eat 
cycllque. 

-  Mot  de  valldlt(  et  d'itat 

Cheque  (qulpement  relll  au  bus  doit  (laborer  et  transmettre  sur  le  bua  I  deacination  du  g(rant 
et  dea  p(riph(rlques  un  ou  dea  mote  de  valldlt(  et  d'itat.  Lea  informations  de  valldit( 
dfitermlnent  la  valldlt(  dea  Inforaatlons  qul  aont  (labor(es  par  l'iqulpement.  Lea  Informations 
d '(tat  sont  dea  informations  de  panne.  11  exlate  done  une  relation  entre  lea  informations  de 
valldlt(  et  d'(tat.  Un  (qulpement  constltu(  d'une  seule  URP  dolt  envoyer  un  mot  d'itat  dont 
lea  bits  repr(sentent  le  r(sultat  de  chaque  autoteat  permanent  dont  11  eat  capable  et  un  bit 
de  synthise  de  panne.  Cea  bits  seront  trait(s  ult(rleurement  au  niveau  calculateur  principal 
ou  g(rant.  Un  (qulpement  constltu(  de  plusieura  URP  envole  un  ou  pluaieura  mots  d'(tata  qul 
.  doivent  (tre  le  compte  rendu  du  bon  fonctlonnement  ou  de  la  panne  de  chaque  UUP  de 
l'iqulpement,  la  logique  de  traitement  (tant  effective  dans  l'iqulpement  lui-m(me. 

.  peuvent  (ventuel lament  (tre  le  compte  rendu  du  r(aultat  dea  autoteata  permanents  dea 
(qulpement a. 

Les  bits  non  utllls(s  dea  mots  d'itat  sont  forcis  i  l'(tat  “Bon  Fonctlonnement" 
Ma^n^enabiMt(_pendant_lp  f^on^ct^l£nne«eftt_Mliitenance 

Le  fonctlonnement  malntensnce  est  r(alis(  prlnclpalement  par  une  trame  d' (change  bua  adapt(e  aux 
besoins  de  la  maintenance.  Lea  (quipements  i  logique  ctbl(e  ne  peuvent  paa  changer  da  mode  de 
fonctlonnement.  Cependant,  un  certain  nombre  de  dispoaltlf a  aont  pr(vua* 

-  Test  daa  entries  analog iques 

Par  analoglque,  11  fsut  comprendre  :  1 'ensemble  daa  Informations  qul  ne  aont  paa  (changing  par 
le  bua  numirique  multiplaxi.  L1 (qulpement  dolt  (tre  capable  de  coder  toutes  lea  Informations 
qu'll  reqolt  an  dehors  du  bua  (discrete,  teneion-aynchroe,  analoglquea  ate.*)  at  da  les 
retranamettra  aur  la  bua.  Les  Informations  qul  ne  sont  paa  envoyiea  aur  la  bus  lore  de  la 
trame  opirationnelle  d' (changes  d' informations  la  seront  aur  la  trame  "maintenance". 

-  Teat  dea  sorties  analoglquea 

Les  (quipements  doivent  avoir  la  posslblllti  de  posltlonner  leura  sorties  analoglquea  1 
certalnes  va leura  1  partlr  de  coomendes  pervenant  par  la  bua,  Le  posit loan ement  peut  avoir 
pour  origin#  : 

.  un  mot  bus  requ  poaltlonnant  une  ou  plusieura  sorties 

.  un  mot  bua  dielenchaat  un  ou  pluaieura  dispoaltlf a  da  poaitionnaattnt  dana  le  caa  oti 
11  n'y  a  paa  de  recopie  dlrecte  d' informations  requet  par  la  bus.  Las  positlonnements 
ae  font  : 

-  soft  i  une  valeur  diflnle 

-  so It  i  un  (cart  par  rapport  1  une  valeur  ectuelle. 

Pour  lea  (quipements  ayant  une  face  parlanta,  laa  iliments  aur  leaquala  on  pout  fairs  une 
lecture  vlauelle  aont  consldirla  comma  sortie  analoglqua. 

-  Rtbouclsge  dss  sorties  analoglquea 

Pour  smiliorar  la  qualltf  du  diagnostic  d'UtP  an  panne,  11  set  demand!  qua  1 '(qulpement  aolt 
capable  de  reboucler  aur  la  diglbua  &  travera  lea  codeura,  touts#  las  Informations  de  aortic 
analoglquea  et  le  rebouclage  dolt  (tre  fait  la  plus  an  aval  possible. 
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EguipWMti  j>  groctwur  reHjifti  but  nualrlgue  multiplex! 

Ce*  iquipeaenta  soot  capabUa  d  *un  fonctlonneaent  Mlntanance  different  du  fonctlonneaent 
opirstionnel  «t  conet Ituent  1*  aajorlti  dee  iqulpeaents  dee  eystlaes  d'arme*  aodernes. 

-  i^il£a£^£tj>£(ratloimal 

Cee  iqulpeaent*  peuvent  disposer  de  tests  diclenchie  globaux,  lie  s'exicutent  dens  les  nines 
conditions  que  dicrlt  eu  pa rag raphe  2.1  pour  lee  iqulpeaents  analoglques  ou  1  loglque  ciblie. 

L' Information  test  en  cours  dolt  itre  Inscrite,  de  plus,  dene  le  not  de  validlti  et  d'itst. 

Un  certain  noabre  de  dlsposltlfs  d’ autotest  sont  diveloppi*  pour  survelller  le  fonctlonneaent  hors 
processeur  de  ces  iqulpeaents.  De  plus,  le  surveillance  dee  ellaentatlone  du  QOS  dolvent  about lr, 
en  ces  de  difeut  ditecti,  1  1' Inhibition  de  le  fonctlon  imieeion  sur  le  bus. 

Test  du  processeur 

Ces  tests  sont  les  aiaes  que  ceux  dicrlts  eu  peregrephe  2.2,  1  sevolr  : 

.  Test  de  le  aimoire  prograaae. 

•  Test  des  llaltes  arlthmitlques  et  loglques. 

•  Test  du  dirouleaent  de  prograaae. 

•  Test  des  codeurs  d'entrie/ sortie. 

La  sanction  de  ces  autotests  dolt  aboutlr  non  seuleaent  1  l’errit  prograaae  en  cee  de  direction 
d'erreur  Mis  eussl  1  1' Inhibition  du  dialogue  bus  en  ialaslon.  Lee  possibility  de  riutllleer  un 
iqulpeaent  difall lent  dicrltes  eu  peregrephe  2.2  sont  tou Jours  valables  lei  et  en  cee  de  rlioi- 
tiallsatlon  corrects,  1' Inhibition  de  l'ialsslon  bus  dolt  itre  levie.  En  felt,  dens  le  plupert  dee 
ces,  e'est  le  chlen  de  garde  qul  lnhlbe  ou  dislnhlbe  le  dialogue  bus  sulvant  qu'll  Indique  "panne" 
ou  "bon  fonctlonneaent". 

Test  1  1‘ Initialisation  du  processeur 

Ces  tests  sont  les  aiaes  que  ceux  dicrlts  au  paragraphs  2.2.  Le  dialogue  bus  ne  sera  eutorlei  que 
si  le  chlen  de  garde  indique  "bon  fonctlonneaent". 

Deux  ces  sont  possibles  : 

.  Le  chlen  de  garde  set  forci  2  "Bo  fonctlonneaent"  pendant  le  phaae  d* initialisation  et  done 
le  dialogue  dlglbus  est  possible  mIb  aliatolre.  Dene  ce  ces,  pendent  le  phase  d* Initiali¬ 
sation,  1'iqulpeaent  dolt  icrlre  dens  son  MVE  une  inforaetlon  "Initialisation  en  cours"  qul 
dlspereltre  quand  le  prograaae  sere  lend. 

.  Le  chlen  de  garde  o’eet  arai  qu'apris  lanceaent  du  prograaae.  Dene  ce  ces,  le  dialogue  dlglbus 
de  1'iqulpeaent  sere  tou jours  vallde. 

Tests  bus 

Ces  iquipeaenta  sont  cepebles 

.  du  test  de  connexion  (voir  peregrephe  2.3). 

.  du  test  conversetlonnel  sur  une  position  d'entrie/sortle. 

Ce  test  consists  *  effectuer  les  opiretlons  sulventes  : 

-  Riceptlon  d'un  aot  de  test  lors  d'un  cycle  d'ichenge  et  rengeaent  dens  une  aiaolre 
"Riceptlon". 

-  Trensfert  de  ce  not ,  sane  tralteaent  nl  calcul,  dens  une  aiaolre  "Emission". 

-  Emission  de  ce  aot  sur  le  bus  lors  du  cycle  d'ichenge  bus  solvent. 

Le  valeur  du  aot  teat  change  I  cheque  riceptlon  dene  1'iqulpeaent. 

Per  ce  aK>yen,  on  coapllte  le  teat  du  COS  et  on  donne  le  poeelblllti  de  virlfler  que  le 
proceeaeur  de  1'iqulpeaent  itabllt  correcteaent  le  dialogue  en  riceptlon  comae  en  ialaslon. 

Le  girent  du  systiae  pilote  ce  teat  et  en  didult  des  pannes  ivsntuelles. 

.  Mot  de  valid Iti  et  d'itst. 

Le  aot  de  valldlti  et  d'itst  sat  llabori  at  ials  cycliqusasnt  sur  le  bus  nuairlqus  dsns  les 
aiaes  conditions  que  dicrlt  dans  le  peregrephe  2.3 

-  £°nc t^lonneaent jss tntenence 

Le  fonctlonneaent  aalntenance  de  ce  type  4'iqulpeasnt  est  diclenchi  per  une  coaasnde  dillvrie  par 
le  girsnt  du  bus,  salable  pour  tout  le  systiae  d'sraes.  k  Is  riceptlon  de  cette  coaasnde ,  les 
iquipeaenta  sbendonnent  leur  fonctlonneaent  opirationasl  pour  o' effectuer  que  dee  tlchts  pureaent 
aalntenance  alees  en  oeuvre  1  l'elde  de  le  traae  d'ichenge  eppelie  "Treae  aelntenence  eu  sol". 

Le  fonctlonneaent  aelntenence  est  dlvlsi  en  deux  parties  : 

.  Les  fonctlone  logldelles  aalntenance  de  base  dont  l'exicutlon  est  diclenchie  die  Is  coaasnde 
dillvrie  per  le  girent  du  bus. 

.  Las  fonctlone  loglclsllss  diclenchie*  per  l'opirsteur  en  fonctlon  de  see  be so Ins. 

Pone t Ions  logic It lies  de  bass  ?  alias  perasttent 

.  Le  codags  et  l'ialsslon  sur  le  bus  aultlplsxi  dee  Inforastione  analoglques  d'entrie  (par 
* ns loglque  11  faut  entendre  touts*  les  Inforastione  ichangies  en  dehors  du  bus). 

•  Posltlonneasnt  des  sorties  "analoglques"  de  1'iqulpeaent  I  pertlr  d'ordres  provenent  du  bus. 

.  Rebouclage  dee  eortles  "analoglques"  perasttent  Is  lever  de  doute  entre  deux  DRP  lors  d'uns 
recherche  de  peons. 

Fonctlone  logldelles  diclenchie* 

.Test*  diclenchi*.  Ces  testa  oot  leurs  algor ithass  risldents  dens  Is  alaolrs  prograaae  de 
1'iqulpeaent  at  soot  diclenchie  par  une  commands  contents  dsns  un  aot  parvanant  par  Is  bus. 

.  Chargeaent  de  logldel  de  test.  Les  iquipeaenta  sont  capebles  do  rec avoir  par  le  bus 
un  logldel  qul  est  chargi  dans  Is  tone  aiaolre  vlve,  et  est  exicuti  par  l'uolti  centrals 
eur  coaasnde  parvenaot  vis  Is  bus. 


Edition  du  contenu  oinoire  progr sums .  Cette  poeslblllti  eet  demandie  pour  tou*  lee  iqui- 
pemenis  et  eet  surtout  utllisie  au  lime  fcheion  de  maintenance  pour  le  contrftle  bit  i  bit  de 
I'lntigriti  du  contenu  mimoire  programme.  Lee  iqulpenents  ayant  une  mimolre  1  tores  ou  EEPROH 
doivent  pouvoir  non  eeulement  (dicer  leur  contenu  mimolre  par  le  bus  male  ausel  pouvolr  (tre 
charges  1  partir  du  bus.  Ce  dlepoeitlf  de  lecture-icriture  peut  (tre  utilise  au  ler  Echelon. 
Test  conversatlonnel  complet.  Ce  test  conslste  i  : 

-  Recevolr  un  certain  nombre  de  messages  permettant  de  rempllr  complitement  toutee  lee 
ninolres  "Riceptlon"  dee  (qulpements.  Lee  Informations  ou  lee  messages  eont  requs  avec 
les  adresses  correspondent  4  1 'ensemble  des  adresses  reception  que  1 'iqulpement  utilise. 
Le  contenu  est  virlfli  par  l'iqulpeaent  1  I'alde  d'une  somme  de  contrftle. 

-  Emettre  dea  informations  sous  forme  de  messages-tests  en  utlllsant  toutes  les  adresses 
(mission  de  1 'iqulpement  concern!#  Le  giraot  du  bus  virlflera,  par  une  somme  de  contrSle 
que  toua  les  messages  ont  correctement  it(  (mis  par  i'iqulpement  sous  test. 

Test  du  chlen  de  garde.  C'eat  un  test  syant  pour  but  de  falre  diclencher  le  chlen  de  garde 
et  done  d'lnhlber  le  dialogue  bus  en  (mission  de  I'iqulpement. 


2.5  E qulpements  i  calculateur  unlversel  rellis  au  dlglbus 

Ce  type  d 'iqulpement  comport*  un  calculateur  travail lant  avec  une  mimoire  de  masse  extirleure,  ginira- 
lement  constitute  par  un  dtsque  ou  une  bande  magnitlque.  La  particularity  de  cette  structure  est  que 
les  zones  "mimoire  programme"  et  "mimolre  de  travail"  ne  aont  plus  fixes  mala  variables  et  labrlquies 
entre  elles.  11  s 'en  suit  que  les  specifications  exposies  au  paragraphs  pricident  ne  s'appllquent  plus 
de  Is  mime  maniire  su  niveau  processeur. 

-  Tea t  de  la_mimo  i£e_p£ogr aams^ris£den£ 

II  est^assurT  par  une  somme  de  controls  s'exer^ant  en  fond  de  tftche  programme. 

-  Test_de  ^a_rfmol£e_p£0£raa^_exicu£abl£ 

11  est  effectuT  par  une  somme  de  contr&le 

.  d'une  part  i  la  fin  du  chargement  dans  la  mimolre  Interne  du  calculateur  du  programme  i  ext cuter. 

Cette  somme  de  contrfile  doit  s'effectuer  en  tiche  prlnclpale  avsnt  tout  lancement  du  programme. 

.  d 'autre  part,  pendant  tout  le  temps  de  fonctlonnement  de  I'iqulpement  une  fols  le  programme 
land  (en  fond  de  tiche). 

Une  fols  le  programme  land,  on  peut  confondre  les  deux  somme  a  de  contrftle  et  n  'en  effectuer  qu'une 
seule  en  addltlonnant  les  Instructions  : 

-  du  programme  resident 

-  du  programme  executable 

et  en  comparant  le  risultat  obtenu  avec  la  somme  des  deux  valeurs  de  consigns. 

-  Test  du  dialogue  awcJLa  sboi^re  de_uiM 

La  mSmolre  de  maase  est  util  isle  dans  deux  buts  : 

.  Inecrire  dsns  la  mimoire  Interne  du  calculateur  un  programme  i  exicuter. 

.  Inecrire  dans  la  mimolre  de  masse  un  certain  nombre  d' Informations  qul  seront  traitls  ultirleu- 
rement. 

Le  coupleur  mimolre  de  mease  a  done  une  Importance  essentlelle  et  11  faut  s' assurer  en  permanence 
q*ie  les  (changes  d* Informat Ions  se  font  correctsmant  dans  les  deux  sens.  Le  test  de  ce  coupleur  est 
riallsi  par  l'inacrlptlon  d' Informations  tast  sur  Is  mimolre  da  masse  pula  relecture  avec  virlfi- 
catlon.  Ce  teat  eat  affactui  an  permanence  pendant  la  fonctionnament  opiratlonnel  da  l'iquipe— nt. 

La  mime  rifle  eat  appllquie  lorsque  l'iqulpement  est  relli  direc tenant  i  une  unlti  de  gestion 
d 'entrle-sortles  autonome  (unlti  de  gestloo  bus  par  example)  ou  un  pirlphirlque  standard 
( tili-lmprtmaur) . 

Aux  dlffirences  dicrltes  ci-dessus,  les  spiclf ications  die rites  su  peragraphe  pricident  s'appllquent 
entlirenent  1  ce  type  d 'iqulpement. 


3  -  LOCICIELS  DE  MAIWTEKAHCB  IMTECREE  DU  CEKAIff  BUS  SYSTEM 

3.1  -  Loxlclsls  exicutis  pendant  le  fooctloooemant  opiratlonnel 

3.1.1  -  Tea tjda  .connexion 

Ce  test  ast  deat ini  i  virlfier  qus  lea  couplsurs  standards  da  bus  (COS)  fonctionnent  correctement. 
Le  girant  bus  systems  virlfle  cycllquamant  qua  tous  las  iqolpements  rellfts  au  bus  numirique  multi¬ 
plex  4  envolent  un  icho-teat  correct* 

3.1.2  -  T«  at_eon ve£ae t£oo ne  1  sur_un«_poa£t£on 

(fe~ test  esT  IsatTnl  T  v(7l7i«r  i qus  les  (qulpements  rsllis  au  bits  numirique  multiplex!  dlaloguent 
corrsctsment  an  ranvoyant  uns  lnformstion-tsst.  La  riaultat  da  ca  teat  n'ast  prla  an  compte,  pour 
un  iqulpement,  qua  dans  la  assure  oil  son  tast  da  connexion  n'lndique  pas  da  panne. 

3.1.2  -  Comp£*£  £«£du*_d^  MintWMc# 

Las  Comptss  Rendu*  dV  HsTnTenancs  (CRM)  permettant,  an  axploltant  lea  riaultata  daa  auto  tests 
permanents  non  perturbants  daa  (qulpements,  da  connaltra  l'itat  du  syetimt  d'srmss.  L'intirit  da 
ca  dlepoeitlf  at  d'autant  plus  grand  qua  la  teux  da  couvartura  daa  autotaata  dea  (quip— ants  eat 
ilavi.  La  logic lei  daa  Comptaa  Rand us  da  Maintenance  a  deux  modes  de  fonctionnament  : 

-  Lea  Comptaa  Rendma  da  V©1  (CIV)  t  c 'ast  la  mimor last loo  at  la  da tat ion  da  toua  las  4v inaments 
da  panna  ditec tls  par  laa  autotasts  antra  la  moment  du  dicollaga  at  1' Instant  da  1 1 at tar ri stags. 


15-7 


I la  permettent  d'obtanlr,  au  aol  : 

.  la  visualisation  dea  Equipementa  ou  dea  URP  qul  aont  tombEs  eo  panne  pendant  le  vol ,  et 
qul  ne  aont  pea  revenua  l  I'Etat  dc  Bon  Ponct lonnement  au  moment  du  toucher  dea  rouea 
(etterrlsaage). 

•  la  visual la«t ion  de  1'hlatorlque  de  vol,  qul  permet  de  connate  re  dans  quel  ordre  et  i 
quellea  dates  (en  t«apa  de  vol)  lea  Equipementa  aont  pasaEs  i  I'Etat  de  panne. 

-  Lea  Cooiptes  Rendua  Sol  (CHS)  :  e'eat  la  posslbllltE  de  presenter  au  mEcenlclen  ou  au  pllote 
I'Etat  InttantannE  du  ayatEme  d'armes  du  point  de  vue  dea  pannes,  avion  au  aol.  11  n'y  a  aucun 
enreglatreaent  dans  la  mEmolre  du  gErant  et  prlaentatlon  : 

.  aolt  dea  Equipementa  ou  dea  URP  en  panne 

•  aolt  dea  mots  d* information  de  panne  de  chacun  dea  Equipementa  suivant  une  selection 
part lcul lire 

en  temps  r£*.l. 

L'exploltatloi:  dea  Conptes  Rendua  de  Maintenance  ne  peut  s'effectuer  qu'au  aol. 

3. 1.3.1  -  Constitution  dea  Comp tea  Rendua  de  Maintenance 

Lea  Comptes  Rendua  de  Maintenance  comportent  plualeura  informations  : 

-  un  Mot  d'Etat  et  dv  Panne  (HEP) 

-  un  code  Equlpement 

-  un  code  de  type  de  panr-i 

-  un  mot  de  datatlon. 

3. 1.3. 1.1  -  Mot  d*Etat  et  de  P^nne 

Lea  mots  d'Etat  et  de  Panne  (MEP)  aont  constituEs  i  partlr 

-  dea  Mots  de  Valldlti  et  d'Etat  (MVE) 

-  dea  mot 8  de  mode 

-  dea  surveillances  exercEes  par  le  gErant  sur  le  dialogue  dlgibua  dea  Equipementa 

-  dea  surveillances  particulltres. 


Mot  deJfeUdltt  ctjd^Etat  (MVE) 

Un  MVE*”est  EmifT  par  cheque  Equipe 
Ce  mot  comprend  deux  parties  : 


ent  connectE  au  dlgibua. 


-  Une  partlc  "valldltE"  qul  lndlque  aux  Equipementa  utillaateura  dea  Informations  g£n£r£es 
sur  le  dlgibua  que  ces  informations  aont  utillsables  ou  non. 

Cette  partlc  du  MVE  n'eat  pea  prise  en  compte  pour  l'Elaborstion  d'un  Mot  d'Etat  et  de 
Panne  (MEP). 

-  Une  partle  "Etat"  (aoua-entendu  de  pannes).  Cette  partle  contlent  le  compte  rendu  du 
rEsultat  dea  autotesta  que  1* Equlpement  dEroule  en  permanence  et  Eventual lament  un  bit  de 
synthEae  de  panne  par  URP  pour  lea  Equipementa  multi- URP. 

.  Moj:  de— Modes  (MM) 

Ce  mot  lndlque  le  mode  dans  lequel  l 'Equlpement  fonctionne.  C'eat  da. a  ce  mot  que  l'on  trouve 
l' information  “Teat  en  Cours".  Le  not  de  mode,  ou  une  partle  de  ce  mot,  eat  prla  en  compte 
pour  1' Elaboration  d'un  MEP. 

.  SurvfUUnceJDljillmi 

Le  dialogue  Digibus  de  tous  lea  Equipementa  qul  y  aont  connect £e  eat  aurveillf  par  le  gErant 
du  systfene  qul  dEtermlne  dea  pannes  dialogue  Eventuellea. 

.  Surveillance^  JtrtUulUrei 
?es  surveillances  Mnt"de  deux  ordrea  : 

-  Lea  Equipementa  non  connectls  au  dlgibua  ont  un  certain  nonbre  d' autotesta  qul  renseignent 
sur  leur  Etat.  Cea  autoteete  concourent  i  1* Elaboration  d'un  ou  de  plualeura  discrete  de 
bon  fonctloimenent  qul  aont  tranemls 

.  aolt  vers  le  gErant  du  ayattme 

.  aolt  vara  un  Equlpemant  qul,  reliE  au  Dlgibua,  le  tranamettra  vera  le  gErant. 

Le  gErant  a  done  la  poaalbllltE  da  confect lonner  un  MEP  pour  1' Equlpement  Enetteur  dee 
discrete  da  bon  fonctlonnement  an  question. 

-  Lea  Equipementa  envolent  aolt  vara  la  gErant  aolt  vera  d'eutree  Equipementa  un  certain 
oombre  d' informations  analoglquee  ou  Dlgibua.  Las  Equipementa  rEcepteura  peuvent  fairs  dea 
teata  de  vraleemblence  sur  lee  lnformetlona  qu'ile  reqolvent,  et  peuvent  done  dEtermlner 
dee  pannes  sur  lee  "Emetteure”* 

Lee  rEeultete  de  cee  surveillances  aont  : 

.  aolt  dlractamant  ElaborEs  par  le  gErant  loraqu'll  effectua  lul-mEme  caa  contrOlea 
.  aolt  dlsponlblee  dans  un  Equlpement  reliE  au  dlgibua  qui  laa  retranemettra  vara  le 
gErent. 

Le  MEP  eet  done  le  reeoemblement  de  toutea  caa  Informations  aur  2  mots  da  16  bits  dans  lesquels 
on  trouve  : 

-  dee  bite  qul  donnent  le  rieultet  dec  eutoteeta  d'un  Equlpement 

-  dee  bits  qui  donnent  le  rEeultet  dee  survcillancee  effectuEea  sur  urn  Equlpement  per  sea 
pEriphErlquea  ou  la  gErant  du  aysttme* 
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3.1. 3.1.2  -  Code  Equlpeaent 

Cheque  Equlpeaent  faisant  l'objet  d'un  CRV  possAde  un  code  qul  n’a  de  valeur  que  pour  ie  gErant 
du  systime.  Leo  Equipements  aont  alnai  hiErarchisfis  impllciteaent  dans  la  table  des  Conptes 
Rendua  de  Maintenance.  Ce  code  Equlpeaent  coaprend  8  bits. 

3.1  3.1.3  -  Code  de  type  de  panne 

4  types  de  panne  peuvent  Etre  dEtermlnEs.  Le  code  de  type  de  panne  coaprend  2  bits. 

Panne8_d£  £yj>e__l  !  Ce  aont  les  pannes  dEterolnEes  par  les  autotests  des  Equipements,  ou  par  le 
gErant  aur  leurs  tests  dialogue  Ce  type  de  panne  peraet  de  consldErer  que  la  oaiatenance  eat 
rEallsEe  par  l'Echange  de  l'URP  fautive  sans  qu'il  solt  n&ceaaalre  d'effectuer  des  recherches 
coaplEnentalres. 

Pannes  de  ty£«  2  :  Ce  aont  toutes  les  pannes  autres  que  celles  dEclarEes  par  les  Equipements 
eux-mEmes  par  1 ' IntermEdlaire  de  leurs  autotest6  ou  le  gErant  sur  la  qualitE  du  dialogue. 

Ce  aont  done  des  pannes  dEtectEes  par  les  "surveillances  partlcullAres" .  Dans  ce  cas,  11  y  a 
peut-Etre  lieu  d'effectuer  des  recherches  coaplEaentaires  avant  de  dEposer  l'URP. 

Pannes  de  type  0  :  Dans  le  cas  oil  11  y  a  panne  puls  retour  A  bon  fonctionneaent,  ll  y  a 
Indication  de  type  de  panne  0  au  moment  du  retour  A  l'Etat  bon  fonctionneaent. 

£annes_d£  £y£e_S  :  Dans  le  cas  oO  une  URP  a  fait  l'objet  de  dix  enreglstreaents  de  panne  pendant 
le  vol,  elle  est  prEsentEe  avec  indication  de  type  de  panne  "S"  pour  "SATURANTE",  quel  que  solt 
le  type  de  panne  du  dernier  enregistrement  :  "1",  "2“  ou  "0". 

3. 1.3. 1.4  -  Mot  de  Datatlon 

En  vol,  chaque  coapte  rendu  de  maintenance  est  enreglstrE  en  m&me  temps  que  l'heure  A  laquelle 
La  panne  correspondante  a  eu  lieu.  Cette  heure  est  exprlaEe  en  nombre  de  cycles  longs  d’Echange 
Le  LSB  de  ce  mot  a  une  valeur  de  160ms  dans  le  cas  du  MIRACE  2000. 


3. 1.3.2  -  Constitution  des  Comptea  Rendus  de  Vol  (CRV) 

Les  Coaptes  Rendus  de  Vol  sont  la  mEaorlsatlon  des  Coaptes  Rendus  de  Maintenance  entre  le  moment 
du  dEcollage  et  le  moment  de  1’atterrissage,  dans  la  mEaolre  du  calculateur  gErant.  Cette  table 
est  mEmorlsEe  dans  une  zone  RAM  ou  RAX  protEgEe. 

3. 1.3. 2.1  -  Datatlon 

Le  coapteur  servant  A  dater  les  CRV  est  als  A  zEro  une  preaiAre  fois  lore  du  passage  sur  la 
position  "Navigation"  du  SElecteur  de  Mode  de  Navigation.  Lors  du  dEcollage,  matErlallsE  par 
1' information  "Train  dEtendu"  le  logiciel  des  CRV  dolt  enregistrer  la  valeur  de  ce  compteur. 
Cecl  permet  de  connaltre  l'heure  de  dEcollage  par  rapport  au  passage  en  "Navigation".  Dans 
le  oEe  temps,  ce  coapteur  sera  reals  A  zEro  afln  de  pouvolr  dater  les  CRV  par  rapport  au  moaent 
du  dEcollage. 

3. 1.3. 2. 2  -  Remise  A  zEro  de  la  table  des  CRV 

La  table  des  CRV  est  remise  A  zEro  lors  de  la  premlAre  information  "train  dEtendu"  consEcutlve 
A  la  mise  sous  tension  du  SystAne  d'Armes. 

3. 1.3. 2. 3  -  Enregistrement  des  CRV 

Au  moment  du  dEcollage,  (train  dEtendu)  il  y  a  : 

-  Remise  A  zEro  de  la  table  des  CRV  (du  vol  prEcEdent) 

-  Enregistrement  de  l'heure  de  dEcollage  (par  rapport  au  passage  en  NAV) 

-  Remise  A  zEro  du  coapteur  horalre 

-  Compa raison  des  MEP  constltuEs  dans  le  premier  cycle  long  suivant  le  dEcollage  et  coaparalson 
avec  le  profil  "Bon  Fonctionneaent"  de  chacun  d'eux. 

Ensulte,  il  y  a  constitution  et  mEaorlsatlon  d'un  CRV  : 

-  lors  du  passage  d'un  MEP  de  l'Etat  Bon  Fonctionneaent  A  l'Etat  panne 

-  lors  du  passage  d'un  MEP  d'un  Etat  de  panne  A  un  autre  Etat  de  panne 

-  lore  du  passage  d'un  MEP  d'un  Etat  de  panne  A  l'Etat  de  bon  fonctionneaent. 

Chaque  MEP  fait  l'objet  d'une  coaparalson  par  cycle  long  d'Echange  (160ms).  La  mEaorlsatlon  des 
CRV  s'arrEte  lorsque  le  contact  de  train  lndlque  "Sol"  (Train  EcrasE). 

3. 1.3.2. 4  -  Limitations 

-  Un  MEP  donnE  ne  peut  Etre  enreglstrE  que  10  fois  au  maximum  au  cours  d'un  vol 

-  Le  nombre  total  de  oEmorlsatlons  de  CRV  est  llaitE  A  128  pour  un  vol. 

3. 1.3. 2. 3  -  Voyant  magnEtlque 

Tout  enreglstreaent  dans  la  table  des  CRV  fait  basculer  un  voyant  magnEtlque  sur  le  tableau 
oEcanlcien.  L* enregistrement  de  l'heure  de  dEcollage  ne  fait  pas  basculer  ce  voyant  qul  est 
rEaroable  manuellement  au  sol. 

3. 1.3. 3  -  Constitution  des  Coaptes  Rendus  Sol  (CRS) 

Les  Coaptes  Rendus  Sol  sont  const ituEs  par  une  table  non  sauvegardEe  dans  le  gErant  du  Dlglbus. 
Cette  table  est  const! tuEe  par  les  coaptes  rendus  de  maintenance  InstantannEs  de  tous  les 
Equipeaents  du  SystAoe  d'Armes. 

Dana  le  CRS  : 

-  La  datatlon  est  forcEe  A  zEro 

-  Il  n 'exists  pas  de  panne  de  type  "SATURANTE". 


t 
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3. 1.3.4  -  Procedure  de  visualisation  des  Coaptea  Rendus  de  Vol 

La  visualisation  des  Coaptea  Rendu*  de  Vol  s'effectue  sur  la  Tite  Basse,  au  sol. 

3. 1.3. 4.1  -  Visualisation  des  pannes  existant  1  la  fin  du  vol 

La  llste  des  URP  en  panne  au  noaent  de  1 ' atterrlssage  est  present 6e  en  tite  basse. 

II  apparalt  : 

-  Une  lire  colonne  de  om&aonlques  de  couleur  verte,  sunsoqtie  du  chlffre  1  traci  en  vert. 
Les  aniaoniques  de  cette  colonne  correspondent  aux  URP  en  panne  de  type  1. 

-  Une  2iae  colonne  de  aniaoniques  de  couleur  aabre,  suraontie  d'un  2  aabre. 

Ces  aniaoniques  Indlquent  les  URP  en  panne  de  type  2. 

-  Une  3£ae  colonne  de  aniaoniques  de  couleur  rouge  suraontie  d'un  S  rouge. 

Ces  aniaoniques  Indlquent  les  URP  en  panne  saturante  (type  S). 

Cheque  colonne  coaporte  au  plus  16  aniaoniques.  Lorsque  le  girant  deaande  la  visualisation  de 
plus  de  16  aniaoniques  dans  une  colonne,  la  tite  basse  ne  visualise  que  les  16  prealers  et 
presence  un  astir lsque  en  bas  de  colonne.  L'opirateur  doit  alors  se  reporter  k  l'hlstorlque  de 
vol  pour  connattre  la  llste  coaplite  des  URP  ou  iquipeaents  en  panne. 

SI  aucune  URP  ou  iquipenent  n'est  en  panne,  aeuls  apparalssent  le  1  vert,  le  2  aabre  et 
le  S  rouge. 


VISUALISATION  DCS  EXISTANT  EN  FIN  DE  VOL 


3. 1.3. 4. 2  -  Visualisation  de  l'hlstorlque  de  vol 

L'hlstorlque  de  vol  est  const Itui  par  l'enseable  des  CRV  qul  ont  iti  enreglstris  pendant 
le  vol  dans  l'ordre  chronologlque  de  leur  aiaorlsatlon.  II  est  prisenti  en  tite  basse. 

Dans  ce  node  de  visualisation  le  prealer  afflchage  est  celul  du  nonbre  de  afasorlsatlons  de  CRV 
effectuies  en  vol,  sulvl  de  l'heure  de  dicollage  exprlaie  en  heures,  alnutes,  secondes, 
d lx lines  de  seconds. 

Le  second  afflchage  est  celul  du  ler  CRV  enregistri,  sous  la  forae  de  4  llgnes  superposies  : 

-  La  prealire  llgne  lndlque  le  nuairo  d'ordre  du  CRV,  l'iqulpeaent  concerni  et  le  type  de 
panne  (0,  1 ,  2  ou  S) 

*  -  La  seconde  llgne  lndlque  l'heure  de  aiaorlsatlon  en  heures,  alnutes,  secondes,  dlxliaes 

de  seconde. 

X  '  -  Les  3e  et  4e  llgnes  de  16  caractires  chacune  reproduisent  le  IBP  correspondent.  Pour  tout 

bit  I  1  dans  le  HEP  on  visualise  un  point  et  pour  tout  bit  i  0  (c'est-i-dlre  slgnlflcatlf 
de  panne),  le  rang  du  bit  dans  le  aot  du  HEP. 


V 


On  peut  ensulte  dirouler  tous  les  CRV  d'un  vol  dans  le  sens  croissant  ou  dicrolesant. 


L'heure  de  dScollage  est  toujours  pr£sent£e  d  l'appel  de  la  procedure. 
Si  aucune  memorisation  de  CRV  n'a  eu  lieu  en  cours  de  vol,  il  y  aura  au 
inscrite  sur  la  tfcte  basse. 


oina  l'heure  de  decollage 
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Procedure  de  visualisation  des  Comptes  Rendus  Sol 

Les  Comptes  Rendus  Sol  ont  pour  but  de  presenter  l'£tat  instantanne  du  systdme  du  point  de  vue  des 
pannes.  La  visualisation  s'effectue  sur  la  TSte  Basse,  au  sol. 

-  Visualisation  des  Equlpements  en  panne  actuelle 

La  liste  des  URP  en  panne  actuelle  est  prfsentfce  sur  la  Tfite  Basse* 

La  visualisation  pr$sent€e  est  semblabie  2  la  liste  des  UUP  en  panne  des  Comptes  Rendus  de  Vol* 
La  colonne  des  pannes  saturantes  est  vide  car  une  panne  actuelle  ne  peut  pas  fctre  saturante. 
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3. 1.3. 5. 2  -  Visualisation  de  l'ltat  actuel  d * un  Equipeaent 

L'^tat  actuel_ d'une  URP  est  prlsentl  sur  la  Tlte  Basse. 

Pour  visualiser  l'ltat  actuel  d’une  URP,  on  frarpe  au  PCN  un  nombre  de  2  chlffres,  qui  est  le 
nu®£ro  dictionnaire  de  I'lquipement  auquel  l'UP?  est  rattach&e*  Apparalt  aiors  en  t&te  basse  un 
Cofflpte  Rendu  Sol  sous  forme  d’un  ensemble  de  4  lignes. 

•  12 re  ligne  :  numfiro  de  1 'Iqulpeaent,  noa  de  1  'Iqulpement,  type  de  panne  (1,  2,  0) 

.  2e  ligne  :  date,  forc&e  A  0 

.  3e  et  4e  lignes  :  MEP  de  X1 Squipement,  prlsente  comae  en  visualisation  de  l'historlque 
de  vol. 

La  frappe  d'un  autre  nua€ro  fait  apparaltre  le  Coapte  Rendu  Sol  correspondent  en  lieu  et  place 
du  prfccfcdent. 


prtnoNiauE  EOUlPtrtNT 


3. 1.3.6  -  Panne  d’un  Iqulpement  utilise  pour  lea  Comp tea  Rcndua  de  Maintenance 

En  cat  de  panne  du  calculateur  glrant,  celle-ci  est  indlqule  par  lea  visualisations  operation-*- 
nellea.  Les  m^morisatlons  de  CRV  dljl  effectules  sont  perduee.  Aucun  nouveau  traltement  ne  peut 
2tre  cf fee tut  et  11  est  done  impossible  de  presenter  un  compte  rendu  quelconque.  En  visualisation 
de  Compte  Rendu  de  Maintenance,  le  glrant  secours  provoquera  la  visualisation  des  rltlcules  1,  2 
ou  S  avec  le  mntaonlque  CP  en  colonne  1. 

En  ce  qui  concerne  les  autres  Iqulpements  ntcessalree  A  la  visualisation  des  compte*  rendus  de 
maintenance,  les  pannes  Iventuelles  seront  dStectles  par  les  autotests  dtcleochls,  plus  per formants 
que  les  autotests  permanents. 

3.2  -  Maintenance  complement sire  au  sol 

Les  autotests  permanents  des  Iqulpements  et  du  systime  ont  une  certaine  limits  du  fait  qu’lls  dolvent 
se  dtrouler  sans  perturber  le  fonctlonnement  optratlonnel.  11  e'en  suit  que  la  profoodeur  des  tests 
n'eat  pas  toujour s  sufflsanta  pour  dltecter  et  locallsar  les  pannes  avec  la  performance  attendue  d'un 
premier  Ichclon. 

La  maintenance  compllmentalre  au  sol  dolt  done  permettre  de  compllter  les  autotests  permanents  en 
rendant  possible  la  verification  de  tous  les  lllments  qui  ne  peuvent  l'ltre  qu'en  perturbant  le 
fonctlonnement  optratlonnel  du  systlme  d'armes.  Les  prlnclpales  f one t ions  2  assurer  sont  les  sulvantes 

-  Validation  des  transmissions  d' Informat Ions  analoglques  entre  les  difflrents  Iqulpements  et  avec 
lea  armes. 

-  Permettre  des  tests  plus  profonda  dans  les  Iqulpements  en  utlllsant  des  tests  dlcleocbls  spiel fi- 
ques  dont  les  algorithm**  sont  solt  rlsldents  dans  las  Iqulpements,  solt  "chargesbles"  I  partlr 
d'une  mlmolre  de  masse. 

-  Qualification  exhaustive  du  dialogue  dlglbus  des  Iqulpements. 


L 
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3.2.1  -  Lo^lciels  de_b£8£ 

Cea  loglclela  permettent  de  donner  au  mfcanlcten  tous  lea  moyens  de  dialoguer  avec  1 e  systEme  afin 
qu'll  pulsse  metier  3  blen  toutes  lea  opErations  de  verification  qul  lul  semblent  nEcessalres  afin 
de  localiaer  une  panne  ou  de  vallder  une  chalne  fonctionnelle. 

3. 2. 1.1  -  Loglclel  Trame  Sol 

En  configuration  maintenance  au  8ol,  le  aystEme  fonctionne  aulvant  un  mode  particulier. 

II  faut  consldEref  deux  types  d 'Equlpements  : 

-  Lea  Equlpements  analoglques  pour  lesquela  lea  operations  de  maintenance  ne  peuvent  se  falre 
qu'en  utilisant  le  mode  de  fonctionneoent  operationnel  et  en  simulant  2  I'entrEe  un  ensemble 
de  paramEtrea  coherenta. 

-  Lea  equlpements  programmes  numeriques  pour  lesquela  le  fonctlonnement  maintenance  eat 
particulier,  le  programme  operationnel  eat  arrete  au  profit  d'un  programme  permettant  : 

.  de  poaitlonner  dlrectement  3  une  valeur  donnee  par  le  Dlgibus  lea  dlfferenta  paramEtrea 
de  sortie  analoglques  (hors  Dlgibus). 

.  de  coder  aur  le  Dlgibus  la  valeur  de  toutes  lea  entrees  analoglques 

•  d'accuellllr  dana  leur  memo ire  RAN  et  d'exEcuter  des  loglclela  charges  3  partir  du  Dlgibus 
.  de  derouler,  3  partir  d’un  ordre  donne  par  le  Dlgibus,  des  tests  Internes  complEmentalrea. 

Les  valeurs  de  posit lonnement  des  paramEtrea  de  sortie  analoglques  sont  delivrees  A  l'alde  de  Codes 
de  DonnEes  Maintenance  de  Posit lonnement  (CDMP). 

Les  valeurs  dea  paramEtrea  analoglques  d'entree  sont  donnee9  dana  les  Codes  de  Donnees  Maintenance 
de  Lecture  (CDML). 

Le  dEclenchement  des  loglclela  de  test  chargEs  et  dea  teats  complEraentalres  s'effectue  3  l'alde  des 
Codes  de  DonnEes  Maintenance  de  DEclenchement  (CDMD). 

La  trame  sol  est  done  le  support  de  la  transmission  des  Informations  nEcessalres  3  la  realisation 
des  fonctlons  dEcrltea  ci-dessua. 

La  trame  sol  comprend  : 

-  Tous  lea  messages  eois  sur  Dlgibus  en  trame  operationnel le  mala  dont  la  cadence  est  rEdulte 

£  une  fols  par  cycle  long  et  dont  le  contenu  n'est  paa  algniflcatlf  ;  cecl  d'une  part  pour  ne 
pas  avoir  une  trame  d'Echange  trop  complexe  et  trop  chargee  3  gErer,  et  d’autre  part,  pour  ne 
pas  avoir  une  charge  de  calcul  trop  importante  au  niveau  du  gErant  du  dlgibus.  Cependant, 

un  certain  nombre  d 'Equlpements  demandent  que  quelques  echanges  s'effectuent  au  "rythme  + 

operationnel"  afin  de  pouvoir  conserver  un  fonctlonnement  maintenance  correct. 

-  Les  messages  permettant  de  valideT  les  cbalnes  analoglques,  c'est-3-dire  leB  CDMP  et  CDML 

-  Lea  messages  permettant  de  charger  dans  les  Equlpements  dea  loglclela  de  test 

-  Les  messages  permettant  de  dEclencher  des  teats  complEmentairea  charges  ou  residents  (CDMD) 

-  Les  messages  permettant  de  lire  et/ou  d'Ecrlre  dana  la  raEmoire  du  gErant  ou  dea  Equlpements 

-  Lea  messages  de  visualisation  maintenance  aur  le  PCN  et  la  TEte  Basse.  ' 

3. 2. 1.2  -  Loglclel  de  Dialogue  SyatEme 

La  gestlon  des  CDMP,  CDML,  CDMD  eat  faite  par  le  raEcaniclen.  Lors  du  passage  de  la  trame  opera- 
tlonnelle  3  la  trame  maintenance  aol,  lea  valeurs  des  CDMP  sont  telles  qu'elles  dfflnlssent  un 
Etat  initial  maintenance  pour  le  systEae  ;  a  priori,  toutes  les  valeurs  sont  poaltionnEea  3  z£ro. 

Les  CDMD  sont  toutes  posit tonnEea  4  z£ro.  Le  loglclel  de  dialogue  permet  au  mEcaniclen  *. 

-  de  posltlonner  les  paramEtrea  analoglques  3  une  valeur  cholste  par  lul, 

-  de  lire  les  valeurs  des  param3tres  analoglques  choisls  par  lul 

-  de  dEclencher  les  tests  coraplEaental res  3  son  Initiative. 

L'organe  de  dialogue  utllisE  est  le  Poste  de  Comaande  de  Navigation  (PCN)  qui  poss3de  toutes  les 
commandes  nEcessalres,  ainsl  que  les  ElEments  de  visualisation  indispensables.  La  tEte  basse  est 
utillsEe  comae  bloc-notes,  c'est-3-dlre  qu'elle  permet  de  conserver  l'affichage  des  hult  dernl3res 
operations  effectuEea  au  PCN. 

De  plus,  ce  loglclel  permet  de  donner  au  mEcaniclen  toutes  les  informations  nEcessalres  pour 
surveiller  le  fonctlonnement  maintenance  du  syst3me  d’armes. 

3. 2. 1.3  -  Cestlon  des  loglclels  complEmentalres 

Les  loglclels  coapi&aentalres  sont  charges  solt  dans  le  gErant  solt  dans  les  Equlpements  3  partir 
d'une  procEdure  dfflnle  par  ce  loglclel  de  gestlon.  Les  loglclels  3  exEcuter  sont  contenus  dans  un 
support  Informat ique  interne  ou  externe  3  1' avion  et  connectE  au  dlgibus.  Ce  loglclel  de 
r  gestlon  ne  concerns  que  le  chargement  des  loglclels  3  exEcuter.  L'exploitatlon  des  rEsultats  des  f 

traitements  effectuEs  par  les  loglclels  chargEs  est  assurEe  par  le  loglclel  de  dialogue  systEme. 

*  3. 2. 1.4  -  Cestlon  de  l'outlllage  sol 

Ce  programme  de  gestlon  permet  le  dialogue  avec  un  Equlpement  au  sol  connectE  au  dlgibus. 

II  rend  possible  : 

-  La  lecture  de  tout  ou  partie  de  la  oEaolre  d'un  Equlpement  par  un  outlllage  sol 

-  L'Ecrlture  en  mEmoire  dans  les  Equlpements. 


3.2.2  -  Loglclels  Complement a ire^ 

Las  "loglclels  c^ompTEmentalres  sont  contenus  dans  un  Equlpement  Interne  ou  externe  au  syatEme  et 
chargEs  dans  les  Equlpements  3  l'alde  du  programme  de  gestlon  des  loglclels  complEmentalres. 

t 
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3. 2. 2.1  -  Loglclela  co>pltnnUlrti  dc  teat  mtlgg 

Cea  loglclela  sont  charg(s  et  ex(cut(s  (Una  le  CP  et  ont  pour  but  d'ex(cuter  un  teat  particular 
s'adreasant  3  tout  ou  partle  dea  (qulpementt  du  Syatime  d'Armea.  Ainal,  le  loglclel  de  teat 
Converaat tonne 1  Couplet  (TCC)  permet  de  qualifier  1  cent  pour  cent  la  qualltt  du  dialogue  dlglbua 
de  toua  lea  (qulpeaents  du  syatfcme  d’armea. 

3. 2. 2. 2  -  Loglclela  compKmentalrea  de  teat  (qulpemmnt 

Cea  loglclela  aont  charg(e  et  «x(cut(s  dans  lea  (qulpements  y  comprls  le  gtrant.  tla  aont  ex(cut(a 
en  Interne  dana  lea  (qulpements  concern(s  et  ne  a'adreaaent  en  aucune  faqon  A  un  de  leura 
plriphlrlquei. 

lie  peuvent  $ t re  consld(r(a  cone  dee  autoteata  intemea  complements Ires. 

Note  :  11  faut  blen  reaarquer  que  la  maintenance  lnt(gr(e  ne  conalate  pae  3  rechercher  une  panne 
par  un  proceaaua  automatlque  mala  &  donner  au  m(caniclen  toua  lea  outila  n(cessalres  1  la 
condutte  d'un  d (pannage  ou  1  la  validation  d'une  chalne  fonctlonnelle. 


3.2.3  -  Miae_en  o  eu  v r e __d  e  a__Lo  g  le  ie  bue^Alde  1  ^m_Mm intenmncmj So : 1 

Le  aystfcme  d'armea  ne  peut  passer  en~conf Iguratlon  maintenance  qu'3  partir  du  fonctlonnement 
op(rat lonnel . 

L'avlon  (tant  sous  tenalon,  le  passage  de  la  configuration  optratlonnelle  3  la  configuration 
maintenance  ne  peut  a'effectuer  que  al  : 

-  Lea  conditions  de  a(curit(  armement  aont  rtunlea 

-  Le  train  eat  v(roulll(  baa 

-  Le  commutateur  aecondalre  du  PSH  eat  aur  la  position  "MAINT" 

-  Le  nicanlclen  a  frappt  au  clavier  du  PCN  le  code  de  demande  "Trame  Sol**. 

A  la  reception  de  ce  code  par  le  g(rant,  celul-ci  (met,  en  trame  op(rat lonnel le  et  une  aeule  fois, 
un  code  d'ordre  de  commutation  en  fonctlonnement  maintenance  dea  (qulpements.  Ensulte,  11  y  a  un 
alienee  Dlglbua  de  2  cyclea  longa  pour  peraettre  l'initlallsat ton  dea  (qulpements  en  fonctlonnement 
maintenance  puls  (mission  de  la  trame  maintenance  proprement  dice. 

Le  passage  de  la  configuration  maintenance  ft  la  configuration  op(rat lonnel le  du  systfeme  d'armea 
s'ef fectue  par  : 

-  la  mlse  aur  une  autre  position  que  "MAINT"  du  rotacteur  aecondalre  du  "PSM" 

-  la  mlae  hors  tension  puls  sous  tension  du  systfeme  d'armea. 


4  -  CONCLUSION 

Le  prlnclpe  de  maintenance  tnt(gr(e  d(crlt  tel,  a  (t(  (tudl(  de  telle  sorte  que  lea  dlspoaltlfa 
de  maintenablllt(  repr(sentent  un  pourcentage  faible  dea  materiel  et  loglclel  dea  (qulpements. 

Au  niveau  systfeme,  le  loglclel  repr(aente  environ  25kmota  de  programmes  residents  pour  un  avion 
comme  le  MIRAGE  2000. 

Les  avantages  de  cette  maintenance  lnt(gr(e  aont  multiples  : 

-  Grande  independence  par  rapport  aux  (volutions  des  loglclela  (qulpements 

-  Recherche  de  panne  sans  simulation  dea  conditions  de  vol 

-  Mlae  en  oeuvre  sans  utilisation  de  ooyens  de  teat  ext(r leura  3  1’ avion  sauf  en  ce  qul 
concerne  les  capteura  et  certains  circuits  d' armement 

-  Exploitation  aur  avion  dea  r(aultats  avec  poaaiblllt(  d'avolr  une  bonne  connaiaaance  de 
la  nature  et  de  la  dur(e  dea  pannes  qul  ae  aont  produltes  en  vol  et  qul  ne  aont  pas 
tou Jours  d(celables  au  sol* 

-  Mlae  en  oeuvre  quasiment  lnstantann(e  des  loglclela  permettsnt  les  recherches  de  pannes, 
ou  lea  validations  de  chalnes  fonct ionnelles  du  Systfeme  d'Armes. 

-  Grande  aoupleaae  dana  les  proc(durea  3  utlliaer  pour  effectuer  un  d(pannage,  le  m(canlcien 
utillsant  au  mleux  et  3  aa  aeule  Initiative,  les  dispositifs  d(velopp(e  dans  le  Systfeae. 
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AN  INTEGRATED  AFCS  FOR  THE  "PROFILEM-MODE 
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1 ,  Summary : 

""^Existing  Automatic  Flight  Control  Systems  for  civil  and  military  aircraft  mostly  use 
separate  subsystegisj such  as  the  Flight  Control  Computer  (FCC)  and  the  Thrust  Control 
Computer  (TCC)^Tith  a  very  limited  amount  of  communication  between  the  *black  boxes*'. 

In  most  cases  integrity  reasons  have  dictated  such  a  separation  but  in  order  to  obtain 
optimal  flight  guidance  results  one  should  use  an  integrated  design  (ffiich  for  instance- 
should  reflect  the  coupled  nature  of  such  variables  as  airspeed  and  vertical  speed.' 

Especially  wj-th  the  advent  of  the  Flight  Management  Computer  (FMC)  with  its  flight 

Srofile  management  capability  and  accompanying  new  control  modes  such  as  the 
PROFILE  •'-mode  the  integrated  AFCS  becomes  a  must.  Nevertheless  the  appropriate  control 
system  design  method  should  be  able  to  incorporate  proven  structures. 


In  1979  flight  trials  of  such  an  integrated  (digital)  flight  control  system  in  a 
two-engined  jet  aircraft  (HFB  32o)  demonstrated  the  advantages  of  such  a  concept  / 1 / . 

The  very  promising  results  were  obtained  by  a  joint  effort  of  the  DFVLR  and  German 
companies  working  in  the  aerospace  field,  supported  by  the  Ministry  of  Research  and 
Technology  (BMFT ) . 

For  transferring  these  achievements  to  other  aircraft  that  often  have  extended 
flight-envelopes  a  fast  and  transparent  parameter  design  method  (no  control  design  deus 
ex  machine)  is  required  which  puts  the  control  engineer  in  the  middle  of  the  design 
process  /2/. 

— - " 

This  paper  describes  the  structure  of  integrated  control  system  and  the 

appropriate  parameter  design  method  using  the  AIRBUS  A300  as  an  example.  The  structure 
of  the  system  is  characterized  by  ’.  J 

p  a  mixture  of  feedforward  and  feedback  control  thus 
allowing  to  separate  the  design  of  the  command  and 
disturbance  characteristics;  v  i  2  j 

jo  decoupling  speed-  and  height  loop. 

The  control  system  design  relies  cn  the  knowledge  of  aircraft  and  engine  characteristics, 
both  known  to  the  FMC  or  similar  devices.  To  ease  the  analytic  parameter  design,  the 
relevant  (longitudinal)  aircraft  dynamic  is  simplified  by  the  incorporation  of  well 
proven  basic  loops  such  as  pitch  attitude  feedback  and  N1 /EPR -control . 

n  •  r  hi  > .  ’ 

Within  the  scope  off.this  simplif ication^the  design  engineer  prescribes  eigenvalues  of  the 
entire  system  in  a  straight  forward  manner. ^Energy- saving  aspects  (in  a  higher  frequency 
range)  by  the  reduction  of  throttle  lever  excursions  may  also  be  considered  using  this 
approach. 


List  of  symbols 


EPR 

F 

G 

H 

m 

M 

N1 

U 

V 

Vk 

Vw 

W 

& 

Z 


r 


engine  pressure  ratio 
thrust 

aircraft  weight 
vertical  speed 
aircraft  mass 

dimensional  derivative,  pitch  moment  equation 
fan-speed 

control  input  vector 
airspeed 

flight  path  velocity 

wind  speed 

drag 

state  space  vector 

dimensional  derivative,  Z- force  equation 

elevator 

trim-tail-plane 

pitch  attitude 

flight  path  angle 
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1 .  Introduction 

What  is  new  with  the  PROFILE-MODE?  This  question  is  justified  because  existing 
autopilots  and  autothrottles  do  already  compute  pitch-attitude  and  thrust  commands  which 
let  an  aircraft  fly  along  a  certain  trajectory.  But  as  in  CLIMB-MODE  or  DESCENT-MODE 
airspeed  (Mach)  and  vertical  speed  (H)  are  not  independent  of  each  other,  because  these 
trajectories  are  flown  with  fixed  thrust: 

-  maximum  thrust  during  CLIMB 

-  minimum  thrust  during  DESCENT. 

In  case  were  both  pitch  attitude  and  thrust  are  available  as  control  variables,  as  in 
CRUISE-MODE  or  LAND-MODE,  autopilot  and  autothrottle  have  to  keep  airspeed  or  Mach 
constant  and  the  deviation  from  the  reference  altitude  close  to  zero.  These  are  typical 
hold-modes.  Furthermore  airspeed/Mach  and  vertical  speed  are  not  decoupled  because  this 
desirable  characteristic  can  only  be  achieved,  if  the  automatic  flight  control  system 
(AFCS)  reflects  in  some  way  or  other  the  flight  mechanical  coupling  of  these  variables. 
Conventional  AFCSs  however  do  not  show  cross-links  between  autopilot  and  autothrottle. 

In  our  opinion  the  performance  of  the  PROFILE-MODE  will  profit  from  an  integrated  AFCS 
and  therefore  this  paper  will  concentrate  on  the  description  of  an  appropriate  control 
system  design- method. 

2.  The  control  system  design  method 

2. 1  Ob jec  tives 

The  objectives  of  the  control  system  design  method  were  as  follows: 

o  It  should  allow  to  design  command-  and  disturbance 
characteristics  separately 

o  Flight  path  velocity  and  vertical  speed  should  be 
decoupled  or  if  any  coupling  were  desirable 
it  should  be  deliberately  introduced. 

o  The  design  method  should  rely  on  well  proven  basic 
loops  such  as  pitch  attitude  feedback  and  N1-/EPR 
control,  (see  Fig.l). 

2.2  Simplification  of  the  flight  mechanical  equations 
The  introduction  of  pitch  attitude  (and  rate)  feedback 

■  K©  *  ^  <L  *  Tq-S^  •  Cl) 

allows  to  neglect  the  acceleration  term  in  the  pitch-moment  equation.  Both  the  truncated 
pitch-moment  equation  and  the  pitch  attitude  basic  loop  can  be  incorporated  easily  in  the 
remaining  force  equations. 

The  result  is  a  completely  controllable  and  observable  second  order  system  with  vertical 
speed  H  and  flight  path  velocity  Vk  as  state  variables,  pitch  attitude  command  and  thrust 
as  control  variables. 


x  -  A-)£  -»  B-y 
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Fig.  2  compares  the  step  responses  of  the  complete  4-th  order  aircraft/basic-loop-system 
with  that  of  the  equivalent  second  order  system  using  the  AIRBUS  A300  in  a  cruise 
condition  as  an  example.  The  results  need  no  further  discussion.  The  only  thing,  which 
is  not  yet  realistic  is  the  fact,  that  thrust  as  an  input  variable  is  not  available. 
However,  this  can  be  easily  achieved  using  the  well  proven  Nl/EPR  basic  loop  and  the 
correlation  between  thrust  and  Nl/EPR.  This  latter  characteristic  is  well  known  to  the 
FMC,  which  uses  it  to  predict  optimal  guidance  parameters. 

A  typical  Nl-control  loop  is  given  on  Fig.  1. 

Compar.  r»g  the  time  constants  of  the  elevator  actuation  system  and  the  Nl-basic  loop  with 
the  eigenvalues  of  the  equivalent  system,  they  obviously  can  be  neglected  in  the  control 
parameter  design  process. 
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2.3  Design  of  the  feedforward  (FF)  control 


Having  shown  the  good  approximation  by  the  second  order  system  the  structure  of  an  ideal 
feedforward  system  can  be  sketched  in  a  straightforward  manner.  Given  the  trajectories 
or  model  functions  (see  Fig.  3)  for  a  change  in  altitude. 


(  ,  ^c.  I  ^'e.)  "  ^ 

and/or  a  change  in  airspeed 

CVc(Vc)  *  ■Fmx/Cs) 


CS) 
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one  only  needs  a  control  law  which  gives 

+i  -  -He 

V«  -  Vc 

The  identies  . 
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automatically  hold. 
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The  appropriate  control  law  is  derived  from  the  equivalent  state  space  resp resen tat i on : 


Uc 


B"4-  -  A-xJ 

S  1  -  A-Xc^ 


(9) 


The  block  diagram  of  the  ideal  feedforward  system  is  shown  on  Fig. 


An  essential  part  of  the  design  objectives  has  been  achieved  at  this  point; 


In  case  of  perfect  modelling  and  absence  of  disturbances  one  gets  the  trajectories  as 
they  are  described  in  the  so  called  model  functions  through  feedforward  control  alone. 

The  eigenvalues  of  the  system  have  not  been  touched. 

But  to  cope  with  imperfect  modelling  and  with  ever  existing  disturbances  (wind  etc.)  one 
additionally  has  to  introduce  feedback  control. 


2,4  Design  of  the  feedback  (FB)  control 

For  the  derivation  of  the  appropriate  feedback  control  one  again  uses  the  state  space 
representation  of  the  equivalent  system  which  as  a  first  step  leads  to  the  following 
equat 1 on ; 

Ud  -  B'1.  ^  Xd  -  A-(X-Xc.)}  (10) 

This  control  law,  which  decouples  vertical  speed  and  airspeed  gives  the  ideal  basis  for 
the  then  following  closures  of  altitude  and  airspeed  loops  (see  Fig.  5). 

fid  *  ■*  tej-JUc-RJdt  (ie.4)  (ii) 

Vc,  -J(MVV)  ■*  te*-(Ve-V*))dt  (12) 

Due  to  the  fact  that  vertical  speed  and  airspeed  are  decoupled  the  eigenvalues  of  the 
Individual  loops  can  be  chosen  separately.  Similar  eigenvalues  are  recommended 
considering  energy  aspects. 
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2.5  Superposition  of  feedforward  and  feedback  control 
Both  control  schemes  can  be  superposed 

y  -  Uc  f  y.d  *  y  -*■  yc^s^  os) 


Fig.  6  shows  the  complete  integrated  control  system  and  Fig.  7  show  the  simulated  time 
responses  characterizing  command-  and  disturbance  behaviour  of  the  aircraft  (cruise 
condition)  with  its  integrated  AFCS.  The  simulation  has  been  performed  using  the 
complete  models.  The  reduced  order  state  space  representation  has  been  used  only  for 
design  purposes. 

The  resulting  integrated  AFCS  shows  no  exotic  features:  it  uses  the  same  sensor  and 
control  inputs  as  existing  conventional  systems.  For  instance  control  inputs  and  basic 
loops  can  be  made  identical  to  the  airbus  systems  if  the  trim-tail-plane  is  incorporated 
into  the  integrated  AFCS  by  using  simple  block-diagram  algebra  (see  Fig.  8). 


3.  Reduction  of  throttle  activity 

The  crux  of  all  flight  modes  which  require  a  full-time  autothrottle  action  to  acquire  and 
hold  a  computer  optimized  or  pilot  selected  airspeed  is  the  unavoidable  measurement  of 
unwanted  higher  frequency  wind  disturbances. 

A  V  *  A  Vie  -  aVw  M 


It  is  a  dilemma:  a  FMC  computes  optimal  trajectories  in  order  to  save  fuel.  To  keep  the 
aircraft  flying  according  to  the  optimized  Mach  number  one  needs  a  fulltime  autothrottle 
and  that  again  may  lead  to  increased  throttle  activity  due  to  (see  above)  with  all  its 
unwanted  side  effects. 

In  order  to  alleviate  the  situation  one  can  deliberately  introduce  again  a  defined 
coupling  between  vertical  speed  and  flight  path  velocity.  This  is  not  a  new  Idea  but  the 
previously  shown  design  method  gives  nearly  automatically  the  necessary  structure  as  it 
shown  in  the  following. 


During  cruise  the  X-force  equation 

in-V#  *  T~W  -G'V 


reduces  to 


j.  =  4?  -  A-tt 
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In  case  of  strict  altitude  hold  (H-0)  thrust  activity  Is  proportional  to  the  horizontal 
acceleration. 


Vk  "  — 
VR  vr\ 


04) 


In  case  of  a  constant  increase  in  horizontal  wind  speed  &Vw  in  order  to  keep  airspeed 
constant  the  following  equation  holds 


A  V*  '  Jv«dt  -  1  &  dt  -  aV* 

•  • 

wW*  Vk  ■  Viemequ. 


Of) 


In  case  of  a  ^V-command  Input  (no  wind  case)  the  following  equation  Is  derived  in  an 
analog  manner 

aV«-  /Welt  «/£<*  -  aV  M 

W;+U  V*  " 

Throttle  activity  In  terms  of /^dt therefore  cannot  be  influenced. 


18-5 


The  situation  changes  If  the  altitude  loop  participates  in  speed  aquire  and  hold  actions. 

■A  riequ  *  -  it 

0  <  it  <  1 

In  order  to  keep  the  altitude  constant  in  a  stationary  sense  the  above  control  law  has  to 
be  modified  using  a  washout 

■WvTtqu.  *  -  ^  ‘  ~g“  *  M<requ.  (22) 

Introducing  this  control  law  which  represents  a  defined  coupling  between  the  two  loops 
the  throttle  activity  reduces  to 


U-if— 

( d  *  U-*.)  Ts ) 


3,1  Reduction  of  throttle  activity  for  command  inputs 

Having  an  integrated  system  where  vertical  speed  and  flight  path  velocity  are  decoupled 
it  is  very  easy  to  introduce  the  above  coupling  for  command  inputs. 


rmeq  u.  - 
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with  Fmv(s)  and  Fmh(s)  the  command  input  model  functions.  Fig.  9  shows  a  mechanization 
of  that  command  input  coupling  with  Fmv(s)  *  Fmh(S)  whereas  Fig.  10  compares  the  time 
responses  with  and  without  command  input  coupling. 

3.2  Reduction  of  throttle  activity  for  disturbance  inputs 

The  introduction  of  the  above  coupling  for  the  feedback  portion  of  the  integrated  AFCS 
follows  the  same  guidelines.  .  ♦ 

iHv-tqu  (?&)  *  -  CT.)  (IS) 

VWCfi). 

where  A Fc  (FB)  is  that  part  of  the  thrust  command  which  comprises  all  the  relevant 
feedback  signals,  (see  Fig.  6). 


This  signal  is  added  as  an  additional  command  signal  to  the  (fic-8)  feedback  signal. 

<■**)  *  -  L*c  CW)  (») 

•  >nr-s  9,M 

The  additional  command  signal,  which  is  necessary  for  (Hc-H)  feedback  is  derived  by 
pseudo  integration. 

T"  • 

Atfnsqu.  (TS)  *  - - — ~  *  Attrequ.  (2.*) 

•4.  4  Tt  • » 

A  mechanization  of  this  additional  coupling  is  shown  on  Fig.  11. 

The  effect  of  that  additional  coupling  is  shown  in  Table  1  for  flight  through  vertical 
gusts  and  horizontal  gusts  comparing  standard  deviations 


Table.  ± 


5.  Conclusion 

An  aircraft  which  shall  fly  along  a  given  trajectory  or  profile  in  order  to  fulfil 
certain  requirements  (to  save  fuel  for  instance)  should  have  an  AFCS  with  defined 
characteristics.  This  paper  shows  a  design  method  for  the  vertical  modes  of  an 
Integrated  AFCS  which  already  has  been  flight  tested  successfully.  The  step  by  step 
design  is  simple  and  transparent  through  the  use  of  a  reduced  order  model  of  A/C  and 
basic  loop  dynamics.  It  allows  to  separate  the  design  of  command  and  disturbance 
characteristics  by  a  formal  method.  The  (linear)  design  method  gives  the  structural 
frame  and  control  system  parameters  but  it  leaves  ample  space  for  the  tricks  control 
system  designers  usually  have  at  hand  to  meet  further  real  world  demands. 
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'Acontro  1  philosophy  appropriate  to  future  Jet  VSTOL  aircraft. -end  -whiely  leads  naturally  to  the 
integration  cf  flight  and  engine  control  systems  .is  diseusscdyfr  The  potential  benefits  of  this  class  of 
system  are  stated  and  integration  aspects,  both  in  terms  of  control  laws  and  at  the  hardware  level,  are 
considered.  Some  of  the  areas  surrounding  this  approach  to  VSTOL  control  require  deeper  #«wd£>are 

outlined . 

Introduction 


In  recent  years,  the  capabilities  of  Individual  flight  and  mission  critical  control  systems  have 
advanced  and  the  computing  power  available  to  them  has  increased  rapidly.  As  the  various  systems  have 
become  more  advanced  it  is  becoming  apparent  that  only  through  integration  can  their  full  potential  be 
realised. 

Much  of  the  effort  to  date  has  been  devoted  to  Integrating  mission  critical  systems  with  one 
another.  With  the  advent  of  full  authority  digital  electronic  engine  control,  the  combination  of  this 
system  with  others  becomes  a  more  practical  proposition. 

While  most  variations  on  the  integration  theme  offer  similar  benefits  both  to  "conventional"  and  to 
VSTOL  aircraft,  the  integration  of  flight  and  engine  control  systems  is  especially  appropriate  for  VSTOL 
configurations. 

This  paper  will  show  how  engine  and  flight  control  integration  may  be  seen  as  particularly 
desirable  for  VSTOL  aircraft  If  the  possibilities  of  this  type  of  vehicle  are  fully  to  be  exploited.  It 
will  present  the  particular  benefits  anticipated  and  a  means  of  realising  them,  recognising  that  there 
are  various  levels  of  integration. 

1 .  Handling  Aspects 

The  current  Harrier  family  of  aircraft  is  controlled  in  a  manner  that  may  be  described  as 
conventional  with  the  exception  of  the  additional  nozzle  angle  lever.  With  his  right  hand,  the 
pilot  controls  aircraft  pitch  and  roll,  with  his  feet  he  excercises  directional  control,  and  with 
his  left  hand  he  controls  the  two  degrees  of  freedom  of  the  engine,  namely  thrust  and  additionally 
thrust  direction.  Thus  it  may  be  said  that  with  his  right  hand  the  pilot  controls  airframe 
parameters  and  with  his  left,  engine  parameters.  Any  integration  of  these  two  sides  of  the  control 
coin  that  is  necessary  in  order  to  perform  a  given  manoeuvre  must  be  done  by  the  pilot.  He  must 
choose  between  a  choice  of  three  longitudinal  controls  (pitch  stick,  throttle  control  and  nozzle 
angle  control)  for  which  he  has  only  two  hands. 

Although  in  theory  the  possibility  of  longitudinal  control  ambiguity  exists,  this  does  not 
appear  to  be  a  problem  with  the  Harrier  and  its  derivatives.  It  is  indeed  a  credit  to  the  design 
of  the  aircraft  that  this  method  of  control  works  so  well.  Pilots  regard  the  aircraft  as  offering 
outstanding  versatility  in  both  airfield  (or  ship)  operations  and  in  combat  flying. 

It  could  be  argued  that  this  versatility  is  only  obtained  at  the  expense  of  higher  pilot 
workload,  particularly  in  the  transition  between  Jet-*bort.«  and  wing-borne  flight.  While  some 
studies  would  indicate  that  this  is  the  case  (ref  1),  recent  combat  experience  involving  shlpborne 
operations  in  poor  weather  show  that  the  workload  involved  la  by  no  means  beyond  the  capabilities 
of  well-trained  service  pilots. 

In  spite  of  this  success,  it  would  be  unwise  to  asstime  that  a  future  jet  VSTOL  aircraft  will 
inevitably  be  blessed  with  such  good  handling  characteristics.  Perhaps  more  importantly,  it  la 
attractive  to  free  the  airframe  designer  from  some  of  the  constraints  imposed  by  the  need  to 
provide  inherent  good  handling,  allowing  him  to  explore  more  fully  the  potential  of  thle  class  of 
aircraft.  Furthermore,  electronic  control  systems  themselves  offer  new  freedoms  which  the  designer 
may  wish  to  exploit. 


\ 
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One  avenue  of  research  that  is  being  explored  is  the  development  of  an  integrated  maneouvre 
demand  system.  As  mentioned  above,  the  pilot  currently  integrates  airframe  and  engine  control 
himself  in  order  to  attain  the  desired  maneouvre.  It  would  seem  more  efficient  for  the  pilot 
simply  to  be  able  to  demand  a  maneouvre,  and  for  the  flight  and  engine  control  systems  to  determine 
the  optimum  way  of  attaining  the  maneouvre.  A  maneouvre  demand  system  which  in  addition  requires 
inputs  thorugh  only  two  cockpit  inceptors  would  obviate  the  possibility  of  control  ambiguity. 

There  are  a  variety  of  handling  benefits  that  add  to  the  attractiveness  of  an  Integrated 
maneouvre  demand  system.  The  translation  between  jet-borne  and  wing-borne  flight  is  the  regime 
most  likely  to  raise  handling  problems  in  a  VSTOL  aircraft.  Maneouvre  demand,  with  appropriate 
limits  (e.g.  ct  limits),  can  facilitai  '  transition  flying  and  reduce  pilot  workload.  Furthermore,  a 
maneouvre  demand  system  would  lend  itself  readily  to  integration  with  landing  aids  such  as 
microwave  guidance  systems  to  produce  a  fully  automated  approach  and,  if  desired,  landing  system. 

It  is  essential,  in  fully  and  partially  jet-borne  flight,  to  ensure  that  large  longitudinal 
demands  do  not  result  in  vertical  transients  or  a  serious  loss  of  jet  lift.  Thus,  height  demands 
must  take  precedence  over  longitudinal  demands  in  terminal  flight  phases,  but  limited  longitudinal 
transients  will  be  permitted  if  the  pilot  Inputs  a  large  normal  demand. 

In  combat  flying,  the  ability  to  vector  thrust  has  been  shown  (ref  2)  to  give  tactical 
advantages.  An  integrated  maneouvre  demand  system  can  product  thrust  vectoring  in  a  combat 
situation  in  a  well-behaved  manner.  If  the  pilot  demands  more  normal  acceleration  than  is  available 
*rom  wing  lift  (as  defined  by  reaching  an  OC  limit),  then  a  certain  amount  of  extra  acceleration  can 
generated  from  thrust  vectoring.  In  order  to  avoid  excessive  energy  loss  associated  with  large 
thrust  vector  angles,  it  is  suggested  that  longitudinal  demands  take  precedence  over  normal  demands 
in  up-and-away  flight.  Thus  rapid  deceleration  due  to  thrust  vectoring  would  only  result  from  a 
large  deceleration  demand,  and  not  from  a  large  normal  demand  alone. 


2.  Implementation 

2.1  Conceptual. 

There  are  many  combinations  of  control  possible,  of  which  the  following  description  is  Just 
one  example.  Roll  rate  demand  is  proposed  for  the  lateral  axis  and  sideslip  demand  (perhaps  with  a 
lateral  acceleration  feedback)  blending  to  a  pure  yawing  demand  in  the  hover  for  the  directional 
axis. 

The  solution  to  the  challenge  posed  by  the  symmetric  axes  is  less  conventional.  The  approach 
adopted  here  is  that  the  right  hand  inceptor  should  demand  normal  (z-axis)  maneouvring  and  that  the 
left  hand  Inceptor  should  demand  longitudinal  (x-axis)  manoeuvring.  "Normal  manoeuvring"  would 
consist  of  normal  acceleration,  perhaps  blending  to  normal  velocity  at  the  hover,  and  "longitudinal 
manoeuvring"  would  be  longitudinal  acceleration,  again  blending  to  a  longitudinal  velocity  at  the 
hover.  There  is  a  requirement  for  independent  pitching  of  the  airframe  in  the  hover  (to  allow  the 
pilot  to  inspect  a  landing  site  before  a  vertical  landing).  If  the  control  power  la  available, 
independant  pitching  in  the  form  of  fuselage  pointing  is  a  potentially  beneficial  feature  in  combat 
flying.  This  mode,  in  the  form  of  incremental  pitch  attitude  demand  about  an  approrlate  datum 
(e.g.  landing  attitude  in  the  hover)  can  be  demanded  through  a  rotary  input  on  the  left  hand 
controller.  An  appropriate  Inceptor  design  will  be  described  later. 

2.2  Control  Scheme 


The  key  feature  of  the  concept  presented  above  is  that  the  pilot  no  longer  has  direct  control 
over  any  one  control  surface,  or  over  the  engine.  The  flight  control  system  (FCS)  produces 
motivator  demands  in  order  to  generate  the  required  maneouvre.  Engine  thrust  and  thrust  vector 
angle  are,  as  far  as  the  control  system  is  concerned,  an  extra  pair  of  motivators.  Fig  1 
Illustrates  this;  note  that  there  is  no  "throttle",  but  two  Inceptors,  engine  demands  coming  from 
the  FCS.  AIbo,  there  Is  no  resson  why  the  engine  nozzles  should  not  be  controlled  Independently  of 
each  other  to  give,  say,  enhanced  pitch  control  or  a  greater  e.g.  range  In  the  hover. 

A  variety  of  control  schemes  of  varying  degrees  of  complexity  may  be  imagined  to  satisfy  the 
conceptual  requirements  of  integrated  manoeuvre  demand.  The  symmetric  axes  of  one  particular 
system  of  control  laws  are  illustrated  in  Figs  2  and  3.  They  fall  into  two  separate  parts;  the 
manoeuvre  demand  laws  themselves,  that  resolve  pilot  inputs  Into  motivator  (tallplane)  and 
pseudo-motivator  (normal  and  forward  thrust)  demands,  and  the  pseudo  motivator  control  law  that 
generates  thrust  magnitude  and  nozzle  angle  (or  mean  nozzle  angle)  demands. 

The  longitudinal  axis  of  the  maneouvre  demand  system  basically  uses  longitudinal  acceleration 
feedback  to  generate  a  forward  thrust  demand.  The  normal  axis  is  built  around  normal  acceleration 
demand  with  incidence  limiting  and  a  term  for  pitch  damping.  In  addition,  the  normal  acceleration 
error  signal  is  fed  forwards  through  a  non-linear  function  of  speed  and  incidence  to  provide  a 
normal  thrust  demand  when  aerodynamic  lift  is  exhausted. 

The  two  thrust  demands  are  fed  into  the  pseudo  motivator  control  law.  Since  in  a  vactored 
thrust  engine  a  change  in  nozzle  angle  can  be  accomplished  more  rapidly  than  a  change  In  thrust, 
simply  to  resolve  the  two  cartesian  demands  into  vector  and  magnitude  demands  would  result  In  the 
sort  of  transient  response  of  Fig  4.  The  control  law  of  Fig  3,  by  using  an  estimate  of  the  current 
thrust  provided  by  the  Engine  Control  System  in  the  calculation  of  nozzle  angle  demand, 
synchronizes  the  movement  of  the  nozzles  with  the  actual  engine  response.  Thus  the  transients  of 
Fig  4  will  be  substantially  reduced. 


This  pseudo  motivator  scheme  is  also  designed  to  give  priority  to  normal  thrust  if  the 
demanded  thrust  magnitude  is  greater  than  that  available  (e.g.  when  hovering)  and  to  forward  thrust 
when  the  minimum  thrust  boundary  is  encountered  (e.g.  for  ground  handling  reasons). 

Physical  Integration 

For  the  purpose  of  this  paper,  it  is  Intended  now  to  consider  some  of  the  ramifications  of 
applying  control  laws  such  as  that  Illustrated  to  a  VSTOL  aircraft. 

The  close  functional  integration  implicit  in  this  system  obviously  dictates  that  there  be 
some  degree  of  physical  Integration  of  the  PCS  and  the  engine  control  system  (ECS).  It  is  assumed 
that  the  ECS  will  be  some  form  of  digital  electronic  engine  control  (DEEC),  both  for  reasons  of 
ease  of  communication  between  systems,  and  for  the  consistency  of  engine  response  that  DEEC  Is 
expected  to  confer. 

The  first  question  to  be  addressed  is  that  of  physical  location.  While  it  may  at  first 
appear  desirable  to  co-locate  ECS  and  PCS  computing,  this  raises  problems •  If  the  combined 
computing  is  airframe  mounted,  it  may  not  be  possible  for  it  to  be  in  the  close  proximity  of  the 
engine,  leading  either  to  a  multiplicity  of  wires  between  the  control  system  and  engine  (for  both 
control  of  the  fuel  system  and  signalling  to  the  ECS  of  engine  parameters)  or  to  the  adoption  of 
digital  signalling  to  and  from  engine  mounted  multiplexer  and  A-D/D-A  converters.  Colocation  of 
the  combined  computing  on  the  engine,  while  tidier,  is  again  likely  to  run  into  space  problems,  not 
to  mention  the  unattractiveness  of  placing  all  the  flight  critical  computing  in  such  a  hostile 
environment. 

As  engine  mounted  DEEC  has  already  been  demonstrated  on  both  R-R  Pegasus  (ref  3)  and  PAW 
P-100  engines  (ref  4),  it  Is  suggested  that  engine  demands  (either  of  thrust  or  of  a  combination  of 
engine  parameters  that  will  approximate  to  thrust)  be  generated  by  an  airframe-mounted  flight 
control  system,  while  "inner  loop"  engine  control  is  performed  by  an  engine  mounted  DEEC  unit. 

Communications  between  PCS  and  ECS  must  be  of  high  integrity.  A  digital  databus  of  the  1553B 
type  is  designed  neither  to  provide  the  necessary  level  of  integrity,  nor  the  speed  of 
communication  for  safe  and  satisfactory  integrated  control.  Consequently,  a  dedicated  high 
integrity  data  link  between  PCS  and  ECS  is  needed. 

Any  air  data  required  by  the  ECS  for  optimisation  of  engine  performance  would  be  provided 
from  the  FCS's  dedicated  air  data  sensors  and  computation,  via  the  FCS.  This  will  not  Introduce 
unsatisfactory  delays  in  getting  the  data  to  the  ECS  if  an  asynchronous  multiprocessor  architecture 
(ref  5)  is  used,  rather  than  the  current  monolithic  architecture;  the  asynchronous  multiprocessor 
will  have  a  cycle  time  of  the  order  of  1-2  ms,  while  current  processors  typically  operate  with  a 
cycle  time  of  the  order  of  20  ms. 

Integration  is  not  limited  to  the  FCS  and  ECS.  As  the  control  philosophy  described  was  borne 
of  a  desire  to  rethink  the  way  in  which  the  pilot  may  control  his  aircraft,  attention  must  be  given 
to  the  cockpit,  and  in  particular  the  two  hand  inceptors. 

It  is  envisaged  that  a  miniature  side  stick  will  allow  right  hand  inputs,  namely  normal  and 
lateral  maneouvre  demand.  As  mentioned  earlier,  the  left  hand  will  be  responsible  for  both 
fore-and-aft  and  incremental  pitch  attitude  inputs.  An  inceptor  designed  around  this  requirement 
is  illustrated  in  Fig  5.  Quite  simply,  fore-and-aft  movement  of  the  Inceptor  will  generate 
longitudinal  demands,  while  twisting  of  the  end  segment  of  the  controller  will  generate  the 
pitching  demand.  Inputs  are  in  exactly  the  same  sense  as  the  demanded  response.  Both  axes  of 
Inceptor  movement  will  be  self-centring.  The  tactile  feedback  provided  by  Inceptor  movement  Is 
valuable,  and  a  pure  force/moment  controller  Is  considered  inappropriate. 


The  Technical  Challenges 

No  matter  how  attractive  the  benefits  of  a  novel  system,  there  are  invariably  a  variety  of 
potential  problem  areas;  the  extent  to  which  the  full  benefits  of  a  manoeuvre  demand  system  may  be 
realised  will  depend  at  least  in  part  on  the  overcoming  of  these  challenges  in  a  manner  that  is 
cost-effective.  It  is  appropriate,  therefore,  to  identify  areas  that  may  require  particular 
attention  and  to  consider  how  best  to  address  them. 

The  exact  nature  of  the  manoeuvres  to  be  demanded  by  the  two  Inceptors  will  have  to  be 
considered  most  carefully,  and  in  particular  any  blends  between  modes.  The  need  for  harmony 
between  the  various  axes  will  need  to  be  borne  in  mind,  particularly  in  the  hover.  It  la  possible 
that  the  lateral  control  will  need  to  be  attitude  demand  rather  than  roll  rate  demand  In  the  hover; 
this  will  give  approximately  sideways  velocity  demand,  to  be  consistent  with  the  fore-and-aft 
longitudinal  velocity  demand. 

The  question  of  pilot  acceptability  of  the  unconventional  hover  control,  where  right  hand 
Inputs  will  produce  an  up-and-down  (height)  response  (rather  than  left  hand  inputs  as  in  more 
traditional  VSTOL  control),  must  be  addressed.  It  would  be  desirable  to  obtain  the  opinions  (from 
simulation)  of  both  VSTOL  and  "conventional"  pilots,  since  ultimately  such  a  system  as  tMa  would 
be  flown  by  pilots  without  previous  VSTOL  experience. 
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There  are  ground  handling  implications  of  any  fully  integrated  control  system  where  the  pilot 
does  not  have  direct  control  over  the  engine;  the  ability  to  move  the  nozzles  so  as  to  reduce  the 
risk  of  foreign  object  damage  or  hot  gas  reingestion  while  sitting  on  the  ground;  the  engagement  of 
the  reaction  control  system  to  aid  manoeuvring  on  a  slippery  surface;  checking  engine  acceleration 
before  take-off;  coping  with  high  residual  thrust  while  taxying.  These  are  examples  of  the  less 
obvious  problems  that  may  be  anticipated,  yet  which  must  be  resolved  for  an  operational  system. 

Operational  techniques  and  careful  design  of  the  control  laws  may  answer  some  of  these 
particular  questions,  for  example  giving  priority  to  longitudinal  thrust  demands  when  on  the 
ground.  Such  specifics  as  engine  checks  can  be  enabled  by  means  of  cockpit  switches,  but  in 
general  switches  associated  with  flight  critical  systems  are  to  be  avoided.  Hot  only  are  they  a 
possible  source  of  unreliability,  but  one  has  to  guard  against  the  risk  of  inadvertant  operation  in 
the  wrong  part  of  the  mission  or  the  flight  envelope. 

Achieving  a  satisfactory  level  of  integrity  from  the  combined  engine  and  flight  control 
system  will  require  collaboration  between  the  airframe,  engine  and  systems  manufacturers. 

Different  levels  of  redundancy  and  different  failure  management  philosophies  between  the  PCS  and 
the  ECS  will  not  ease  the  problem  of  communications  between  these  systems.  Bi-directional  fibre 
optic  links  could  be  applied  here  to  good  effect.  A  possible  overall  system  architecture  is 
illustrated  in  Fig  6.  A  triplex  flight  control  system  receives  inputs  from  the  pilot  and  from  air 
data  and  motion  sensors  (plus  any  other  information  required  by  the  system,  like  control  surface 
positions).  The  PCS  communicates  via  bi-directional  links  with  dual  redundant  engine  controllers 
and  receiving  from  them  a  thrust  estimate.  Consolidation  is  performed  at  the  downstream  end  of 
data  flows.  The  flight  control  computers  (FCC's)  also  transmit  demand  signals  to  control  surface 
and  nozzle  actuators.  FCS  inter-lane  communications  are  shown.  Each  FCC  and  engine  controller 
will  also  be  attached  via  an  optically  isolated  Interface  to  remote  terminals  on  a  digital  databus , 
probably  dual  redundant  and  to  MIL  STD-1553B.  (For  clarity,  this  has  been  omitted  from  Fig  6). 

The  databua  interface  will  permit  communication  between  the  flight  critical  systems  (engine  and 
flight  control)  and  non-flight  critical  systems  such  as  navigation,  weapon  aiming  and 
maintenance/diagnostic  systems.  This  would  be  the  channel  for  integration  of  flight  and  mission 
critical  systems. 

It  Is  intended  to  study  the  integration  of  flight  critical  systems  (with  themselves  and  with 
mission  critical  systems)  on  an  Avionic  Systems  Demonstration  Rig  and  an  ACT  rig  at  B.Ae.  Brough  in 
the  near  future.  Along  with  pilot-in-the-loop  simulation,  solutions  to  the  above  problems  will  be 
investigated  and  demonstrated. 

The  "bottom  line"  of  these  deliberations  is  that  any  Integrated  manoeuvre  demand  system  must 
at  least  equal  a  more  conventional  three  inceptor  control  system  in  terms  of  versatility  and  pilot 
workload,  yet  this  must  not  be  at  such  a  price  in  terras  of  cost  and  weight  that  the  customer  finds 
the  solution  unacceptable. 


Concluding  Remarks 


Greater  freedom  to  exploit  the  unconventional  aspects  of  jet  VSTOL  configurations  can  be  conferred 
upon  the  airframe  designer  by  the  adoption  of  a  fully  Integrated  manoeuvre  demand  system.  This  type  of 
control  system  also  offers  piloting  benefits,  especially  in  the  transition. 


The  satisfactory  implementation  of  a  manoeuvre  demand  system  on  a  VSTOL  aircraft,  dictating  as  It 
does  close  functional  and  physical  integration  of  flight  and  engine  control  systems,  requires  coordinated 
study  in  a  variety  of  fields  In  order  to  achieve  a  cost-effective  design. 
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RESUME 

Dans  le  concept  de  la  Commande  Automatique  Generalises  des  avions,  cette  communication  presente 
vine  loi  de  pilotage  manuelle,  non  -conventionnelle,  destinee  a  ameliorer  l'efficacite  de  la  visee 
en  tir  au  canon  air-sol.  La  mise  en  oeuvre  suivant  ur a  architecture  de  syst£me  integrant  une  conduite 
de  tir  air-sol,  un  regulateur  de  tir  et  un  regulateur  de  pilotage  est  detaillee  sous  forme  analy- 
tique.  Par  rapport  aux  systemes  de  commandes  classiques,  1 'innovation  porte  principalement  sur  l'as- 
pect  eiabore  du  traitement  multivariable  des  ordres  du  pilote.  L'appl ication  de  methodes  modernes, 
de  calcul  de  commande  non-lineaire  rend  par  ailleurs  la  loi  bien  adaptee  pour  les  manoeuvres  d'ali- 
gnement  de  grande  amplitude  de  1 'avion.  La  pilotabilite  d'une  version  lineaire  de  la  loi  a  ete 
demontree  au  cours  d’essais  sur  simulateur. 


ABSTRACT 

In  the  Control  (bnfigured  Vehicle  concept,  this  paper  presents  a  manual  and  non-convent ional 
aircraft  control  law  which  provides  an  improved  target  tracking  in  air-to-ground  gunnery.  The  system 
architecture  which  integrates  a  weapon  aiming  system,  a  fire  control  system  and  a  flight  control 
system  is  analytically  detailed.  In  comparison  to  classical  flight  control  systems,  improvements 
come  mainly  from  the  elaborate  processing  of  the  pilot  steering  commands.  The  application  of  modern 
non-linear  control  techniques  to  the  design  of  the  control  law  makes  it  otherwise  well-suited  for  air¬ 
craft  alignment  manoeuvres  of  large  magnitude.  The  controllability  of  a  linear  version  of  the  control 
law  has  been  demonstrated  on  a  manned  simulator. 
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composantes  du  vecteur  vitesse  aerodynamique  dans  le  tri^dre  avion 

composantes  du  vecteur  rotation  instantanee  dans  le  triedre  avion  (roulis,  tangage, 

lacet ) 

angles  d' Euler  (angle  de  gfte,  assiette  longitudinale,  azimut) 

braquages  des  gouvernes  de  gauchissement,  profondeur,  direction 

angles  de  presentation  de  la  cible 

corrections  de  tir  canon  (hausse) 

erreurs  angulaires  de  visee 

vitesse  de  roulis  aerodynamique 

vecteur  vitesse  aerodynamique  de  1 'avion 

vecteur  vitesse  de  la  cible 

composantes  du  vecteur  vitesse  de  la  cible  dans  le  triedre  avion 
coefficients  aerodynamiques  diraensionnels 
termes  de  couplage  gyroscopique 


i.  INTRODUCTION 

Four  assurer  le  pilotage  general  d'un  avion,  il  est  tout  £  fait  envisageable  de  commander 
des  variables  directement  associ£es  &  son  mouvement.  Ce  mode  de  pilotage  "par  objectifs''  (P0)  simp- 
plifie  1 'execution  de  certaines  manoeuvres  exigeant  une  action  coordonn£e  sur  les  gouvernes,  tdche 
autrement  difficile  si  elle  est  confine  au  pilote.  Des  Etudes  de  P0  faites  A  l'ONERA  ont  permis 
ainsi  d'£tablir,  suivant  di verses  methodes,  des  lois  de  braquage  de  gouvernes  appropri£es  a  la  com- 
mande  des  variables  d'etat  du  mouvement  (d£rapage,  vitesse  de  roulis  autour  de  l'axe  avion  ou  autour 
du  vecteur  vitesse,  vitesse  de  tangage,  vitesse  de  lacet  [1-4}).  Les  essais  sur  simulateur  avec 
pilote  humain  dans  la  boucle  ont  mis  en  Evidence  la  pilotabilite  de  telles  lois  ainsi  que  les  qua- 
lit£s  de  vol  am£lior£es  qu'elles  confArent  A  1 'avion.  La  loi  citAe  en  reference  [2]  a  notamment 
4t4  testee  avec  succAa  dans  le  tir  au  canon  air -sol. 

Le  tir  au  canon  air-sol  est  une  phase  de  vol  trAs  critique  oil  un  alignement  raplde  de  1 'avion 
sur  la  cible  et  une  visee  precise,  utllisant  une  hausse  mobile  pour  etendre  le  domaine  de  tir,  requiA- 
rent  d’habitude  une  habilete  et  une  finesse  de  pilotage  partlculiArement  importances  de  la  part 
du  pilote.  La  mise  A  la  disposition  du  pilote  de  variables  de  commands  approprlAes  peut  alors  contri- 
buer  A  alieger  la  charge  de  travail  et  ameilorer  l'efficacite  de  la  visee.  La  loi  de  pilotage  propo¬ 
ses  dans  cette  communication  est  bases  aur  ce  concept  de  PO.  Elle  est  specifique  au  tir  air-sol 
car  des  objectifs  encore  plus  eiabores  que  ceux  cites  plus  haut  sont  mis  en  oeuvre. 


La  mise  en  oeuvre  de '  la  loi  de  commande  suivant  une  architecture  de  systems  integrant  une 
conduite  de  tir  canon  air-sol,  un  regulateur  de  tir  et  un  regulateur  de  pilotage  est  detaillee  sous 


forme  analytique.  La  formulation  mathematique  de  la  loi  de  commande  fait  appel  a  une  methode  de 
commande  non-lineaire  non-interactive  par  laquelle  les  sorties  d'un  systeme  non-lineaire  sont  contro- 
lees  de  maniere  independante. 

Une  simulation  numerique  de  passe  de  tir  air-sol  illustre  le  fonctionnement  du  systeme  de 
commande.  Quelques  resultats  obtenus  sur  un  simulateur  d 'avion  de  combat  et  portant  sur  une  version 
lineaire  de  la  loi  de  commande  sont  egalement  presentes. 


2.  COORDINATION  DES  BOUCLES  DE  PILOTAGE 

Dans  une  passe  de  tir  air-sol,  le  fonctionnement  dans  le  temps  du  systeme  compose  par  la  cible 
au  sol,  1 'avion  et  le  pilote  est  caracterise  par  deux  niveaux  d ' integration.  A  partir  d'un  ordre 
de  braquage  des  gouvernes  du  pilote,  auquel  s'ajoutent  eventuellement  des  ordres  de  stabilisation, 
le  roouvement  de  1 'avion  s'obtient  par  une  premiere  integration  des  equations  dynamiques.  L' integra¬ 
tion  des  equations  cinematiques  donne  ensuite  la  trajectoire  et  il  est  Evident  que,  mis  a  part  i'ef- 
fet  du  rapprochement,  une  modification  de  la  trajectoire  entralne  une  modification  des  positions 
relatives  de  la  cible  et  de  1 'avion.  II  est  done  vraisemblable  que  1  'alignement  de  1 'avion  sur  la 
cible  sera  d'autant  plus  facile  que  la  correction  d&siree  concerne  les  variables  se  trouvant 
plus  en  aval  dans  la  chalne  d* integration. 


1)  Ainsi,  le  contr6le  direct  des  variables  dynamiques  (cf.  [1-4]),  en  donnant  a  l'avion  des 
reponses  pures  et  d^couplees,  contribue  a  reduire  la  charge  de  travail  du  pilote  dans  la  t£che  de 
visee.  La  boucle  de  pilotage-visee  obtenue  avec  un  tel  systeme  est  sch£matisee  sur  la  Fig.  1,  'dans 
1«  cas  ou  le  PO  est  applique  aux  vitesses  angulaires  de  roulis  aerodynamique,  de  tangage  et  de  lacet. 
Les  trois  commandes  classiques  du  pilote  (manche  en  lateral,  manche  en  longitudinal,  palonnier) 
affichent  des  consignes  de  vitesses  angulaires  a  realiser  ;  le  regulateur  de  pilotage  elabore  les 
ordres  de  braquage  des  gouvernes  qui  stabilisent  le  mouvement  de  l'avion  et  assurent  la  realisation 
des  objectifs  affiches.  La  vitesse  longitudinale  de  l'avion  est  suppos&e  £tre  comma ndee  indepen- 
damment  au  moyen  de  la  poussee-moteur,  non  representee  sur  la  figure. 


ordres  pilote 
-objectifs  de 


lere  integration 

gouvernes _  variables  du 

\  mouvement 


2e  integration 


PO  a*  consignes  de  vitesse  de  roulis  aerodynamique,  de  vitesse  de  tangage  et  de  vitesse  de  lacet 
a  realiser. 

CCPI  *  calcul  continu  du  point  d* impact  (conduite  de  tir  air-sol) 

Fig.  1  Boucle  de  pilotage-visee  avec  un  niveau  d 'integration. 


2)  Le  contrdle  direct  des  variables  cinematiques  se  heurte  au  fait  que  lr  pilotage  des  avions 
s'effectue  norraalement  en  vitesse  et  non  en  position.  Par  ailleurs,  1 'automatisatlon  totale  rendrait 
necessaire  la  mesure  des  variables  cinematiques  (ici  la  distance  avion-cible,  les  erreurs  de  pour- 
suite,  etc...)  et  entralnerait  par  consequent  une  complication  de  la  chalne  des  capteurs. 

3)  La  solution  adoptee  ci-apres  se  place  entre  les  deux  cas  decrits  plus  haut,  en  ce  sens 
qu'elle  realise  unc  commande  manuelle,  en  vitesse,  preservant  done  des  conditions  classiques  de 
pilotage,  facilitant  cependant  la  visee  grflee  a  1 'existence  d'une  relation  directe  entre  la  reponse 
des  erreurs  de  visee  et  1 'ordre  du  pilote.  Elle  consiste  A  etablir  une  loi  de  variation  des  vitesses 
angulaires  de  l'avion  (objectifs  de  pilotage  du  cas(l))  qui  annule  les  erreurs  de  vis4e  suivant 
une  dynamique  specif i£e.  Dans  ce  but,  la  boucle  est  "ferrate"  par  le  pilote  qui  estlme  les  erreurs 
de  vi9&e,  ce  ies-ci  n’etant  pas  mesur£es  A  bord.  Pour  calculer  les  ordres  de  braquage  des  gouvernes 
qui  r£allsent  la  loi  de  variation  des  vitesses  angulaires  pr£c&dentes,  il  suffit  d'utiliser  le  r4gu- 
lateur  de  pilotage  de  la  Fig.  1.  La  boucle  de  pilotage-vis£e  obtenue  avec  le  systeme  propose  est 
repr£sent£e  sur  la  Fig.  2. 

La  boucle  interne  de  stabilisation  et  de  pilotage  est  identique  A  celle  repr6sent£e  sur  la 
Fig.  1,  1 'entree  du  regulateur  de  pilotage  £tant  tou jours  des  consignes  de  vitesse  de  roulis  aero¬ 
dynamique,  de  vitesse  de  tangage  et  de  vitesse  de  lacet  A  realiser.  Ces  consignes  issues  du  regulateur 
de  tir  sont  calcuiees  de  sorte  que  si  1 'ordre  du  pilote  (affichage  de  deux  quantites  homogenes  A 
des  ingles)  est  identique  A  cheque  instant  A  l'erreur  de  visee,  cett'»  derniere  tend  vers  zero.  Le 
pilote  joue  done  en  quelque  sorte  It  rflle  d'un  estimateur  d'etat.  La  pilotablllte  d'un  tel  systeme 
(rrobieae  de  pompage  pilote,  par  exemple)  n’est  pas  assuree  a  priori  et  devra  fctre  v£rifiee  sur 
un  simulateur  avec  pilote  humain  dans  la  boucle.  Quelques  considerations  d'ordre  analytique  aur 
la  pilotabilite  sont  exposeea  au  chapitre  suivant,  montrant  en  partlculler  que  la  ligne  de  visee 
est  contrdiee  en  vitesse  au  travers  des  ordres  du  pilote. 


La  commande  de  roulia  mise  A  la  disposition  du  pilote  est  presentee  A  1 'entree  du  regulateur 
de  tir  sous  forme  d'un  angle  de  gtte  A  rallier,  cecl  pour  rester  homogene  avec  lea  erreurs  de  visee 
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Ordres  de  manoeuvre  *  consignes  de  Vitesse  de  roulis  aerodynamique,  de  vitesse  de  tangage  et  de 
vitesse  de  lacet  a  rAaliser  (cf.  Fig.  1) 

Fig.  2  Boucle  de  pilotage-visAe  avec  deux  niveaux  d' integration. 


qui  sont  des  variables  cinAmatiques.  Afin  de  respecter  la  contrainte  de  pilotage  en  vitesse,  l’affi- 
chage  de  1' angle  de  gite  desire  s'obtiendra  par  integration  des  deplacements  latAraux  du  manche 
ou  efforts  latAraux  sur  le  manche. 


Un  avantage  de  1 ’architecture  de  systeme  presentee  sur  la  Fig.  2  est  que  la  stabilisation 
du  mouvement  de  1 ‘avion  est  assuree  par  une  boucle  indApendante.  Le  pilotage  general  de  1 '•  on 
semblable  A  celui  dAfini  sur  la  Fig.  1  s'obtient  par  simple  commutation  des  ordres  du  pilot  >ur 
1’entrAe  du  rAgulateur  de  pilotage  ;  1* avion  ne  se  trouve  done  jamais  en  boucle  ouverte,  " ‘"le  au 
moment  de  la  commutation. 

Dans  le  chapitre  suivant,  les  lois  de  regulation  du  rAgulateur  de  tir  et  du  regulateur  de 
pilotage  sont  formulAes  suivant  une  mAthode  de  calcul  de  commande  non-linAaire,  prenant  explicitement 
en  compte  les  non-linear itAs des  equations  cinematiques  d’une  part,  des  Aquations  dynamiques  d'autre 
part.  GrAce  aux  lois  non-lineaires ,  les  manoeuvres  de  grande  amplitude  de  l’avlon,  notamment  en 
roulis  pour  rallier  une  cible  lateraleoent  trAs  ecartee,  peuvent  Atre  ainsi  realisees  avec  une 
grande  precision. 


3.  FORMULATION  MATHEKATrQUE  DES  LOrS  DE  REGULATION 

T 

Le  problAme  consiste  a  etablir  une  loi  de  braquage  des  gouvernes  U  * 
qui  permet  de  ramener,  sous  un  angle  de  gite  quelconque  affiche  par  le  pilote  et  suivant  une 

dynamlque  spAciflAe,  un  point  du  viseur  vers  un  autre  point  du  viseur.  Le  premier  .jpoint  est  la  cible  , 

liAe  au  sol  et  dont  les  angles  de  presentation  dans  le  viseur  sont  »e^)  t  i  le  deuxiAme 

est  le  point  d' impact  des  obus  au  sol  calculA  par  la  conduite  de  tir  a  borfl  de  1 'avion  et  dont  la 

position  dans  le  viseur  est  donnAe  par  les  corrections  de  tir  ou  hausse  z  «  (h  .h^/  Fig. 3  ).  j 


e  ,e  ■  erreurs  angulaires  de  viaAe 

y  * 


Fig.  3  Angles  de  presentation  de  la  cible  dans  le  viseur  et 
corrections  de  tir  canon  air-sol  (hausse). 
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Coone  il  est  lndiquA  plus  haut,  une  loi  de  variation  des  vitesses  angulaires  *  *  (p#,q,r) 
de  l'avlon  est  d'abord  calculAe  pour  annuler  les  erreurs  de  vlsAe  z'z  *  “r”*rd  "  '€y’€»,T 
(loi  de  regulation  du  rAgulateur  de  tir).  Une  loi  de  braquage  des  gouvernes  est  ensuite  calculAe 
pour  rAallser  les  ordres  de  manoeuvre  prAcAdents  ainsi  que  pour  stabiliser  le  mouvement  de  l’avion 
(loi  de  regulation  du  rAgulateur  de  pilotage). 

Equations  cinAmatiquea  et  dynamiques 

T  T 

Le  vecteur  control  A  d ’ordre  supArleur  du  rAgulateur  de  tir  *g  *  vArifie 

l' Aquation  cinAmatique  non-linAalre  auivante  : 

*.  -  WV*'*’  *  VV*.>n  ■  (1) 

avec  *  *  (d.B)1  «t  n  *  <P.q.r)T  .  X  e»t  la  dlatance  avion-clble  projetie  aur  l'exe  longitudinal 
da  l'avlon.  four  le  tir  alr-aol,  il  aat  co«ode  de  ndgliger  la  viteaaa  de  la  cible  devant  celle 
de  l'avlon,  c'eat-4-dire  ?  . 

Lea  dquatlone  du  aouveaent  de  l'avlon  a'exprlaent  par  lea  ralationa  dlffdrentielles  non-llndalrea 
suivantaa  : 


f 

* 

5 

\ 

\ 

| 
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i  ■  A(x)  ♦  By 

avec  x  -  (x*,QT,x*>T  .t  xv  -  (V,«)T 

corame  un  parametre  du  systeme. 

Le  vecteur  control©  du  regulateur  de  pilotage 
lier  1' equation  dynamique  non-lineaire  suivante  : 


*  (2) 

.  La  vitesse  longitudinale  u  est  consideree 

z  »  (pa»4ir)^  “  DCft.x^)  verifie  en  particu- 


z  ■  C:Kx)  ♦  B:Hx)y  . 


(3) 


L'expression  des  differentes  matrices  est  donnee  en  annexe. 


Loi  de  regulation  du  regulateur  de  tir 

La  valeur  vers  laquelle  doit  tendre  le  vecteur  controle  z  est  egale  a  : 


La  commande  non-interactive  suivante 


<cf.  [4,5]  )  : 
n  -  -b‘1[c  -z 

8  S  8 


sd 


>1 


(4) 


ou  0  est  une  matrice  diagonale  3  x  3,  et  ou  Bs  et  Cg  sont  les  expressions  non-lineaires  de 
l'etat  figurant  dans  l'Eq.(l),  donne  p«i r  substitution  de  ft  dano  l'Eq.  (1)  1' equation  dif ferentielle 
lineaire  et  decouplee  suivante  : 


Pour  des  valeurs  de  zstj  constantes  ou  constantes  par  morceaux,  l'erreur  de  poursuite 

est  nulle  en  regime  permanent  moyennant  un  choix  approprie  de  la  matrice  P  .  La  loi  de  commande 

(4)  a  ainsi  pour  effet  d'eliminer  algebr iquement  les  non-1 inearites  de  l'Eq.  (1). 


Dans  les  conditions  normales  de  fonctionnement  du  regulateur  de  tir,  plus  precis&nent  lorsque  la 
distance  de  tir  n’est  pas  nulle,  la  matrice  Bs  est  tou jours  inversible  et  le  systeme  (1)  est  done 
controlable. 


La  loi  (4)  presente  1 ' inconvenient  de  ne  pas  pouvoir  contrer  asymptot iquement  des  perturbations 
ou  des  erreurs  de  modelisation  ;  l'erreur  sur  les  matrices  B  et  cg  provient  6ventuellement  des 
erreurs  de  mesure  des  variables  d’etat,  de  l' avion,  ou  encore  ou  fait  quo  la  cible  n'est  pas  fixe 
au  sol.  Une  solution  consisterait  a  utiliser  une  loi  non-interactive,  proport ionnelle  et  integrate 
de  la  forme  :  ,  t 

n  -  -B~‘[C.*OZ  /  (t  -z  )<ftj  , 

8  8  8  o  8  sd 

ou  p  et  A  sont  des  matrices  diagonales  3x3.  Par  substitution  de  £  dans  1 'equation  non-lineaire 
(1),  satisferait  1 'equation  dif ferentielle  lineaire  suivante  : 

t  ■  -Pr  -A  ( z  -z  ) 

8  8  8  Sd 

On  montre  que  pour  des  perturbations  additives  constantes,  l'erreur  de  regime  permanent 
serait  nulle.  Le  vecteur  *8  n'6tant  pas  mesure,  sauf  pour  la  3e  composante  <J>  ,  il  a  ete  juge  plus 
simple  de  mettre  en  oeuvre  la  loi  proport ionnelle  (4)  et  de  laisser  au  pilote  la  charge  d'estimer 
les  ecarts  \  "  zr”*rd  et  '‘ompenser  les  perturbations  au  moyen  de  son  affichage  sep  •  ^ 

(4)  est  alors  £valuee  au  point  courant  de  fonctionnement  **  “  £ep+Ir<j  ’•  de  m£me,  la  distance 
projetee  X  avion-cible  dans  la  matrice  c8  (cf .Eq . (1 ) )  est  rcmplac£e  par  ia  distance  D  avion-point 
d' impact,  puisqu 'aucune  mesure  sur  la  cible  n'est  supposee  faite. 


La  relation  ordre  du  pilote-r£ponse  de  l’erreur  de  visee  possede  les  propriet&s  suivantes  : 

-  si  'ep  “  zc  ,  alors  lim  “  0  »  t*co  i  si  1 ’ordre  du  pilote  est  identique  a  cheque 

instant  a  l'erreur  de  vis£e,  l'erreur  de  visee  tend  done  vers  7.6ro. 

-  si  zcp  "  0  ,  alors  *e(0)  -  0  ■>  *£(t)  -  0  Vt  ;  si  1 'ordre  uu  pilote  est  nul , 

le  point  d'impact  des  obus  reste  fixe  sur  le  sol. 


-si  ♦  ■ 
approchde  entre 


constante,  4^  pouvant  prendre  des  valeurs  de  0 
K  e9t  donnfce  par  : 

*e  *  'Vt,*  T*  VV  ■ 


A  2tt 


ep 


une  relation  analytique 


oil  P_  “  di«g(pi  ,P2 ) ,  Pi  et  Pj  6tant  les  deux  premiers  elements  de  la  diagonale  de  la  matrice  0 
(cf.  Eq.(4))  .  Pour  une  distance  avion-cible  fixe,  U-UT  '  0  et  la  vitesse  angulaire  de  la  ligne 
de  vis^e  est  done  proport ionnelle  A  1 'ordre  du  pilote.  Le  point  d'impact  instantan£  des  obus  devient 
immobile  au  sol  quand  le  pilote  annule  son  affichage. 


Loi  de  regulation  du  regulateur  de  pilotage 

La  loi  de  comnande  (4)  se  realise  en  fait  suivant  une  certaine  dynamique  qui  est  celle  de 
l'avion  donn6e  par  Eq.  (2).  La  valeur  vers  laquelle  doit  tendre  le  vecteur  contr6l£  a  est  ainsi 
6gale  A  : 

‘d  ‘  B(IW  • 

Qd  se  substituant  A  0  dans  Eq.  (4). 

La  poursuite  de  t d  par  s  se  fait  au  travera  d'un  regulateur  de  pilotage  structure  en  deux 

niveaux  : 


[ 
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-  le  premier  niveau  reproduit  une  reponsea^convergeant  vers  zd  maniere  ideale  mais  restant 
representative  du  mouvement  de  1* avion,  grace  a  un  modele  d'avion  defini  par  des  equations  dynamiques 
ou  n'intervient  aucune  perturbation  exterieure  ;  il  conditionne  la  maniere  dont  1  avion  doit  repondre 
aux  ordies  de  manoeuvre  de  grande  amplitude  ; 

-  le  deuxieme  niveau,  qui  est  l'organe  veritable  de  regulation,  asservit  avec  une  dynamique  relati- 
vement  plus  rapide  le  mouvement  reel  de  1'avion  a  la  reponse  du  modele,  ce  qui  implique  une  compensa¬ 
tion  d ’une  part  des  erreurs  de  modelisation,  d’autre  part  des  effets  des  perturbations  exterieures. 


Ce  partage  en  deux  niveaux  de  regulation  assure  une  bonne  manoeuvrabilite  de  1'avion  (ler 
niveau),  associee  un  bon  comportement  en  presence  de  turbulence  (2eroe  niveau). 

1)  Afin  de  mieux  rendre  compte  au  ler  niveau  du  comportement  de  1’avion  reel,  et  d'avoir  ainsi 

des  gains  importants  au  2eme  niveau  pour  contrer  les  perturbations  exterieures,  un  modele  d'avion 
non-lineaire  est  utilise,  regi  par  les  equations  non-lineaires  (2).  L’application  d’une  methode 
de  regulation  non-lineaire  semblable  a  celle  utilisee  pour  le  regulateur  de  tir  donne  la  loi  de  com- 
mande  suivante  (cf.  Eq.(3)):  t 

’  'b::  1|c::‘aVA0f  ( V2d)dT|  ■  (5) 

L' indice  m  indique  que  les  variables  appartiennent  au  modele.  On  verifie  que  la  matrice  B:*  est  inver- 
sible,  c'est-a-dire  que  le  systeme  (3)  est  controlable.  L'erreur  de  poursuite  "zd>  est 

nulle  en  regime  permanent  moyennant  un  choix  approprie  des  matrices  diagonales  g.  et  A  .  [/utilisation 
d'ur.e  loi  proportionnelle  et  integrale  au  lieu  d'une  loi  proportionnelle  permet  en  outre  d’accrot- 
tre  le  nombre  des  parametres  de  reglage  et  par  consequent,  une  plus  grande  liberte  dans  le  choix  de 
la  forme  de  la  reponse  (amortissement,  frequence). 

2)  Le  2eme  niveau  utilise  une  methode  classique  d'optimisation  lineaire  avec  un  indice  de 
cout  quadratique  pour  etablir  une  loi  permettant  d'une  part  la  poursuite  du  vecteur  zn  du  modele 
par  le  vecteur  z  de  1'avion,  garantissant  d’autre  part  la  stabilite  de  1'avion  en  boucle  fermee. 
La  loi  est  amelioree  du  point  de  vue  de  la  robustesse  (annulation  des  effets  des  erreurs  de  modelisa¬ 
tion  et  des  perturbations  exterieures)  grace  a  la  technique  exposee  dans  [3,6)  .  La  stabilisation 
du  mouvement  de  1'avion  est  etudiee  avec  un  vecteur  d'etat  reduit  x  e  (XT,0T)T  -  C  x 

relatif  a  la  dynamique  seule  de  1'avion.  r  v  r 

L'ecart  £xr  “  xr“xnn  entre  1’avion  et  le  modele,  ainsi  que  l’erreur  de  regulation  e  *  z-z^ 
sont  donnes  par  le  systeme  linearise  suivant,  en  remarquant  que  z  *  CCx^)  : 

6xr  *  F6xr+G6u+6j 
e  ■  H6x  +6 2 

°“  «#  ’  »-V  F  '  Cr  ‘  V  “  «  ’  ta/So’  Uf.  Eq.(2)). 

Le  point  de  linearisation  xn  correspond  au  vol  rectiligne  uniforme.  Les  quantit&s  6i  et  S2  rendent 
compte  des  residua  de  linearisation  de  A  (x)  et  C  <Xr>  respectivement .  Pour  des  valeurs  de  f ,  et  o, 
constantes  par  morceaux,  le  systeme  pr£c£dent  est  equivalent  au  systdme  : 


F  oU6il  fcl 

M  +1  6u 

H  0  e  0  “ 


On  verifie  que  le  systeme  est  controlable.  La  minimisation  de  1 'indice  de  coflt  quadratique  : 

J  ■  /  {(6x^  e^lQ  +6u^R6u}dt  , 

ou  Q  et  R  sont  des  matrices  de  pond^ration ,  donne  la  loi  optimale  : 


■(emit  visEu44,iLOTiLfT7^jriducD'i>-<td14>(  •  ™-cu!_>  r  “'u(  ww'-v '  i"AU>+8“  itdrti: 

!  *<«  T  T  11%  <?%  -tj)  12e  nive*uf  *vi0".rd«f 

1 _ J  m  m  a.  d  non-lindaire 


rioo 

*r  010  l« 
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Fig.  4  Repriaentation  du  ayetime  de  coomande  sous  forme  mathimatique 
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c'est-a-diie  : 

t 

u  =  6u_+y  *K  ( x  -x  )+K.  /  (z-z  )dl 

-0  1  r  rm  2QJ  m  (6) 

La  reponse  du  systeme  commande  par  la  loi  (6)  est  done  telle  que  : 

6x  ♦  0  «t  e  +  0  lorsque  t  «►  «  • 

r 

Dans  l'Eq.  (6),  ym  est  donne  par  Eq.  (5),  K  3  ^Ki»K2^  est  la  matrice  des  gains  optimaux  et  ^y^ 
est  une  constante  d'integration  qui  peut  6tre  elle-meme  optimisee  [3]  .  La  valeur  de  6y^  est  prise 
ici  egaie  a  0  pour  simplifier. 


Les  differentes  etapes  conduisant  a  1 ’elaboration  des  braquages  des  gouvernes  a  partir  des  ordres 
du  pilote,  sont  resumees  sur  la  Fig.  4. 


t“3secondes 


t  i 


Fig. 5.  Simulation  numlrique  d'une  passe  de  tir  air-sol 
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4.  SIMULATION  DE  PASSES  DE  TIR  AIR-SOL 

Les  resultats  d'une  simulation  nuroerique  d’attaque  au  sol  sont  montres  sur  la  Fig.  5.  Les 
conditions  de  la  simulation  sont  definies  par  une  vitesse  initiale  de  l'avion  egale  a  230  m/s,  une 
assiette  Longitudinale  initiale  egale  a  -2°  et  un  angle  de  gfte  initial  mil.  La  loi  de  P0  a  ete 
utilises  pour  toute  la  uuree  de  la  passe  de  tir,  y  compris  la  phase  de  ressource  evasive  ;  aucune 
commutation  de  lois  de  pilotage  n'est  done  faite.  Les  coordonnees  initiales  de  la  cibie  dans  le 
repere  avion  (X  =  1800m,  Y  =  400m,  Z  =  150m)  traduisent  des  conditions  assez  severes  concernant 
la  presentation  de  l*avion  face  a  la  cibie  (altitude  relativement  basse,  ecart  lateral  initial  impor¬ 
tant).  Ces  conditions  ont  ete  choisies  pour  verifier  les  performances  du  systeme  de  commande  pour 
des  manoeuvres  de  roulis  de  grande  amplitude. 


La  pig*  5  montre  que,  la  cibie  etant  lateralement  tres  ecartee  a  1' instant  initial  (0,22  rd  ), 
une  commande  simultanee  4>d  »  90°,  Cyp  =  0  et  ezp  *  0,05  rd  est  affichee  par  le  modele  de 
piiote  (suppose  parfait  et  sans  retard,  ni  dynamique).  L'effet  de  la  commande  est  de  produire  dans 
le  repere  lie  a  l’avion  une  rotation  de  la  cibie  autour  de  la  ligne  de  visee,  l'erreur  de  visee 
initialement  laterale  devenant  progress! vement  longitudinale.  A  partir  de  1' instant  t  »  Is  ou  l'angle 
de  gtte  commande  est  atteint,  la  commande  czp  .te  entralne  une  reduction  rapide  de  l'erreur  de 
visee  longitudinale  ;  la  variation  de  l'erreur  de  visee  laterale  n'est  pas  affectee,  conformement 
au  decouplage  recherche.  L'azimut  evolue  rapidement  et  au  moment  ou  l’erreur  de  visee  devient  infe- 
rieure  a  0,08  rd(t  *  2,7s)  le  modele  de  piiote  annule  la  commande  et  effectue  les  corrections  fi¬ 
nes  (e  =  e  ,  e  =  e  ).  L'erreur  de  visee  est  pratiquement  annulee  a  partir  de  1' instant 
t  =  4s.  V  * 


yp 


zp 


Le  modele  de  piiote  affiche'-yp*  0  et  t  zp  *  -0,07  rd  a  1’ instant  t  =  5s  pour  commander  la  res¬ 
source  d'evasive,  puis  <  =  -90°  A  l1 instant  t  =  7s  pour  commander  le  degagement  lateral. 

Bien  que  sur  le  plan  analytique  il  soit  montre  que  le  systene  de  P0  permette  une  amelioration 
de  la  visee  tout  en  preservant  les  conditions  classiques  de  pilotage,  la  pilotabillte  d'un  tel  sys¬ 
teme  doit  etre  verifiee  sur  un  simulateur  avec  un  piiote  humain  dans  la  boucle.  1'ne  version  lineaire 
de  la  loi  de  pilotage  [7,8]  ,  Limitant  les  manoeuvres  de  l'avion  a  de  faibles  angles  dc  roulis  (infe- 
rieurs  a  20°),  a  ete  testee  par  4  pilotes  d'essais  sur  un  simulateur  d'avion  de  combat.  La  faisabi- 
lite  du  concept  du  pilotage  du  point  J’ impact  ou  controle  en  vitesse  de  la  ligne  de  visee  a  ete 
verifiee  par  les  pilotes,  des  appreciations  favorables  sur  ce  mode  de  PO  ayant  meme  ete  formulees* 
faciiite  de  pilotage,  visee  tr£s  stable. 


I  ERREUR  DC  VISEE 
LONG.  (RD) 


Y  (M) 


cibie 

X  (M) 


Fig. 6.  Simulation  pi  lot£e  d'une  passe*  de  tir  air-sol 

La  Fig.  6  montre,  avec  la  meme  version  de  regulateur  lineaire,  1 'enregist rement  d'une  passe 
de  tir  typique  ou  sont  repr£sent£es  de  gauche  a  droite  : 

-  1 'evolution  des  erreurs  de  visee  ‘  v  '  z  J  e’est  aussi  la  trace  des  obus  au  sol,  la  cibie  etant 
situce  au  centre  de  la  figure  ; 

-  la  trajectoire  de  l'avion  (evasive  non  representee). 

Les  courbes  sont  graduees  tous  les  bOOm  par  un  asterique  (*)  a  partir  d'une  distance  fixe 
egale  A  2400m  de  la  cibie.  I.es  croix  (  +  )  materialised.  Les  instants  du  tir.  Sur  cet  exemple,  la 
force  du  vent  lateral  est  £gale  a  20  noeuds  ;  sur  la  ciblc  de  dimension  4m  x  4m,  le  piiote  a  obtenu 
un  score  simule  de  20  obus  ;  la  vitesse  a  l'instant  du  tir  est  egale  a  479  noe  ids. 


5.  TRAJECTOIRE  D’APPROCHE  NON-RECTILIGNE 

Une  approche  non-rectiligne  sur  une  cibie  defendue  augmente  les  chances  de  survie  de  l'avion 
par  rapport  a  une  approche  rectiligne.  Le  systeme  de  PO  de  la  Fig,  4  permet  un  dAplacement  de  l'avion 
tout  en  maintenant  la  vis£e  stabilis&e  grAce  a  la  commande  de  roulis. 

Le  piiote  dispose  en  effet  de  3  commandes  pour  piloter  l'avion  : 

-  commandes  de  vitesse  de  deplacetne.it  de  la  liRne  de  vis£e  z  ; 

-  commande  de  roulis  :  ,  .  ' 

a 
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Lorsque  cp  est  nul,  le  point  d* impact  demeure  superpose  &  la  cible  ;  il  est  facile  de  voir 
que  si  1' angle  de  glte  de  1 ’avion  est  nul>  la  trajectoire  sera  contenue  dans  un  plan  vertical.  Une 
mise  en  roulis  en  visde  stabilise  a  done  pour  effet  d’incurver  la  trajectoire  d'approche.  Le  depla¬ 
cement  de  1 ’avion  peut  Stre  mis  en  Evidence  en  examinant  Involution  de  1'axe  cible-avion  repdrd 
par  les  angles  de  gisement  et  de  site  G  et  S  (cf.  Fig. 7). 


Simulation  numdrique  d'une  trajectoire  de  viade  stabiliade 
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Moyennant  une  hypothese  s implificat rice  const scant  a  figer  la  distance  avion-cible,  les  valeurs 
de  regime  permanent  des  vitesses  angulaires  G  et  S  en  visde  stabilisee  peuvent  dtre  exprimee  analy- 
tiquement  en  fonction  de  I* angle  de  gite  : 

G  -  C  =  (qsin<j+rcos^)/cose 
S  -  -t  *  -qcosC+rsin? 

avec 

q  -  acosC 
r  *  bsintf  » 

les  quantitds  a  et  b  dependant  de  la  distance  et  des  coefficients  aerodynamiques  de  1 'avion.  La 
Fig.  7  represente  la  variation  de  la  droite  cible-avion  pour  une  distance  fixe  egale  a  750m.  La 
variation  maximale  en  gisement  est  obtenue  avec  un  angle  de  gite  egal  a  ±  45°  quelle  que  soit  la 
distance.  La  variation  en  site  est  maximale  pour  ♦>  -  0  ou  i  -  ±  90°  suivant  les  valeurs  respectives 
de  a  et  b.  II  convient  cependant  de  verifier  que  ces  configurations  correspondent  a  un  cas  de  vol 
realiste  ;  d  titre  d'exemple,  la  courbe  6(c)  a  etd  gradude  en  derapage  (jusqu’a  12°)  et  en  facteur 
de  charge  lateral  (jusqu'd  lg),  la  vitesse  de  I'avion  etant  egale  d  230m/s.  On  constate  sur  cet 
exenple  que  si  le  derapage  dtait  limitd  a  5°  et  le  facteur  de  charge  lateral  d  0.5g,  1 'angle  de 
gite  maximum  autorisd  pour  incurver  la  trajectoire  serait  infdrieur  d  20°. 


L'dtude  paramdtrique  prdcedente  ne  donne  qu’une  valeur  de  rdgime  permanent  et  approchde  de 
la  variation  de  la  droite  cible-avion,  l'hypothdse  simplificatrlce  d'une  distance  constante  ayant 
ete  faite.  La  Fig.  8  montre  le  ddplacement  de  I'avion  sur  une  simulation  numdrique  de  passe  de  tir 
ou  le  moddle  de  pilote  affiche  zcp  a  0  et  ^  •  45°.  Le  ddplacement  latdral  est  egal  a  24m  au  bout 
de  4,4  secondes  (instant  de  la  rcssource)  ;  par  rapport  d  la  trajectoire  rectiligne  de  mdme  pente 
initiale,  le  ddplacement  vertical  est  de  33m.  La  visee  est  stabilisde  avec  une  erreur  infdrieure 
a  0,5°  en  regime  transitoire. 


6.  CONCLUSION 

Pour  augmenter  l'efficacitd  de  la  visde  en  tir  au  canon  air-sol,  une  loi  de  pilotage  non-conven- 
tionnelle  a  etd  proposde.  Par  cette  loi,  la  ligne  de  visde  est  coooandde  en  vitesse  au  travers  des 
ordres  de  pilotage  du  pilote.  La  mise  en  oeuvre  de  la  loi  suivant  une  architecture  de  systdme  compor- 
tant  un  regulateur  de  tir  et  un  rdgulateur  de  pilotage  placds  en  cascade  permet  la  stabilisation  du 
mouvement  do  I'avion  au  travers  d'une  boucle  inddpendante.  L'utilisation  des  mdthodes  de  calcul 
de  comaandes  non-lindaires  dtend  le  dooaine  de  vol  de  I'avion  d  des  manoeuvres  d'alignement  de  grande 
amplitude  sans  nuire  a  la  prdcision  de  la  visde.  Les  rdsultats  de  simulation  montrent  que  le  systdme 
de  pilotage  facilite  les  corrections  de  visde  en  tir  air-sol  tout  en  sauvr  ,  rdant  les  conditions 
du  pilotage  classique. 
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